medium
6.9
CWE
119 787
Advisory Published
CVE Published
Updated

CVE-2010-3848: Buffer Overflow

First published: Tue Oct 19 2010(Updated: )

Description of problem: Reported by Nelson Elhage. <a href="https://access.redhat.com/security/cve/CVE-2010-3848">CVE-2010-3848</a> AF_ECONET kernel stack overflow <a href="https://access.redhat.com/security/cve/CVE-2010-3849">CVE-2010-3849</a> AF_ECONET saddr-&gt;cookie NULL dereferences <a href="https://access.redhat.com/security/cve/CVE-2010-3850">CVE-2010-3850</a> AF_ECONET SIOCSIFADDR ioctl does not check privileges The two main vulnerabilities lie in the econet_sendmsg() function. If CONFIG_ECONET_AUNUDP, the function declares a variable-length array of iovec's on the stack: static int econet_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr *msg, size_t len) { ... #ifdef CONFIG_ECONET_AUNUDP ... struct iovec iov[msg-&gt;msg_iovlen+1]; ... #endif "msg-&gt;msg_iovlen" is a user-controlled value &lt;= 1024; 1024 'struct iovec's is enough to overflow the kernel stack and clobber the 'thread_info' struct on either 32- or 64-bit systems with or without CONFIG_4KSTACKS. The code populates 'iov' with user-controlled values, so this is almost certainly exploitable for privesc. The second bug is conveniently labeled as such for anyone who cares to look: /* BUG: saddr may be NULL */ eb-&gt;cookie = saddr-&gt;cookie; In fact, 'saddr' comes from userspace and may be NULL (if non-NULL, it will have been copied to kernelspace), leading to a NULL-pointer dereference. This saddr-&gt;cookie dereference appears twice, once in the "hardware" case and once in the "UDP emulation" case. This is easily exploitable for an oops, but probably not anything more. The final issue is in the ec_dev_ioctl function. The SIOCSIFADDR ioctl does not check privileges, allowing an unprivileged user to assign econet addresses to arbitrary interfaces. It is possible this is intentional, but AFAIK it would be unusual for SIOCSIFADDR to be unprivileged, so this may be an accident. Note that it is necessary to use this property in order to make the first two bugs exploitable, since econet_sendmsg will return almost immediately if no econet addresses are configured. Reference: <a href="http://seclists.org/oss-sec/2010/q4/236">http://seclists.org/oss-sec/2010/q4/236</a>

Credit: secalert@redhat.com secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
debian/linux-2.6
Linux Linux kernel<2.6.36.2
SUSE Linux Enterprise Server=10-sp3
SUSE Linux Enterprise Server=9
SUSE Linux Enterprise Desktop=10-sp3
SUSE Linux Enterprise Software Development Kit=10-sp3
Suse Linux Enterprise Real Time Extension=11-sp1
Debian Debian Linux=5.0
Canonical Ubuntu Linux=10.10
Canonical Ubuntu Linux=9.10
Canonical Ubuntu Linux=8.04
Canonical Ubuntu Linux=10.04
Canonical Ubuntu Linux=6.06

Remedy

http://openwall.com/lists/oss-security/2010/11/30/1

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=644156

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203