CVE-2014-9644: Low severity Linux Linux kernel vulnerability

Linux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API that allows any local user to load any installed kernel module on systems where CONFIGCRYPTOUSERAPI=y by abusing the requestmodule() call.

In the introduction of Crypto User API in the linux kernel in version 2.6.38 introduced a defect which granted userspace applications to load kernel modules on the system, by abusing the requestmodule() kernel call. This patch also fixes the

The kernel accomplished loading algorithms by searching for the matching kernel module name provided when a user attempts to use a socket via the AFALG socket type. Initially there were no checks involved in validating the name of the module, users could provide string and the kernel would attempt to load a module by that name in the default search path for the specific version of the kernel.

This CVE fixes additional attack vector which by abusing the template module loading format. It solves the attack vector in which targetmodule(cipher) would evade the existing protection mechanism introduced when fixing in CVE-2013-7421.

External reference: https://lkml.org/lkml/2013/3/4/70 https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu http://seclists.org/oss-sec/2015/q1/229

Fixed with these 3 commits: https://git.kernel.org/linus/5d26a105b5a7 https://git.kernel.org/linus/4943ba16bbc2 https://git.kernel.org/linus/3e14dcf7cb80

— Red Hat

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AFALG socket with a parenthesized module template expression in the salgname field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

— Launchpad