CVE-2013-7421: Low severity Canonical Ubuntu Linux vulnerability

Mathias Krause reports:

Linux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API that allows any local user to load any installed kernel module on systems where CONFIGCRYPTOUSERAPI=y by abusing the requestmodule() call.

In the introduction of Crypto User API in the linux kernel in version 2.6.38 introduced a defect which granted userspace applications to load kernel modules on the system, by abusing the requestmodule() kernel call.

The intention was to allow applications to leverage in-kernel cryptographic functionality and load the requested module on demand.

The kernel accomplished loading algorithms by searching for the matching kernel module name provided when a user attempts to use a socket via the AFALG socket type. Initially there were no checks involved in validating the name of the module, users could provide string and the kernel would attempt to load a module by that name in the default search path for the specific version of the kernel.

The proposed fix for CVE-2013-7421 solved the issue for the simple use case, however there was an additional attack vector which by changing the string formatting any module can still be loaded.

External reference: https://lkml.org/lkml/2013/3/4/70 https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu http://seclists.org/oss-sec/2015/q1/229

Fixed with these 3 commits: https://git.kernel.org/linus/5d26a105b5a7 https://git.kernel.org/linus/4943ba16bbc2 https://git.kernel.org/linus/3e14dcf7cb80

I have only done light testing and they seem to solve it for me.

— Red Hat

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AFALG socket with a module name in the salgname field, a different vulnerability than CVE-2014-9644.