CVE-2014-9645: Input Validation

Matthias Krause reports:

modprobe uses the "basename" of the module argument as the module to load, as can be seen here:

bbox:~# lsmod | grep vfat bbox:~# modprobe foo/bar/baz/vfat bbox:~# lsmod | grep vfat vfat 17135 0 fat 61984 1 vfat bbox:~# find /lib/modules/uname -r -name vfat.ko /lib/modules/3.18.0-rc5+/vfat.ko

It should instead fail to load the module -- actually fail to find the module.

This can even be abused to load arbitrary modules by nullifying enforced module prefixes some of the Linux kernel's subsystems try to apply to prevent just that:

bbox:~# lsmod | grep usb bbox:~# ifconfig /usbserial up ifconfig: SIOCGIFFLAGS: No such device bbox:~# lsmod | grep usb usbserial 32201 0

The actual modprobe invocation, done by the kernel was: /sbin/modprobe -q -- netdev-/usbserial

Due to the bug, the "netdev-" prefix including the "/" are ignored and the usbserial.ko module gets loaded.

The same works for filesystems, e.g.:

bbox:~# lsmod | grep sndpcm bbox:~# mount -t /sndpcm none / mount: mounting none on / failed: No such device bbox:~# lsmod | grep sndpcm sndpcm 88826 0 sndtimer 26606 1 sndpcm snd 61141 2 sndpcm,sndtimer

This time the kernel called out to: /sbin/modprobe -q -- fs-/sndpcm

Note the "fs-" prefix.

External reference: https://bugs.busybox.net/showbug.cgi?id=7652 (cert maybe expired)

— Red Hat

The addprobe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /sndpcm none /" command.

— Launchpad