medium
6.9
CWE
362
Advisory Published
CVE Published
Updated

CVE-2015-7613: Race Condition

First published: Fri Oct 02 2015(Updated: )

A data race that can trick the kernel into using initialized memory was found. This vulnerability can at least give access to arbitrary SysV shared memory. It is almost certain that this vulnerability can be used to gain arbitrary code execution in the kernel. While working on KTSAN, Dmitry Vyukov got a report that says that ipc_addid() installs a not-completely initialized object into the shared object table. In particular, uid/gid are not initialized. ipc_obtain_object_check() in turn obtains the object and verifies uid/gid for permission purposes. Since the fields are not initialized, the check can falsely succeed. Race report: ThreadSanitizer: data-race in ipc_obtain_object_check Read at 0xffff88047f810f68 of size 8 by thread 2749 on CPU 5: [&lt;ffffffff8147d84d&gt;] ipc_obtain_object_check+0x7d/0xd0 ipc/util.c:621 [&lt; inline &gt;] msq_obtain_object_check ipc/msg.c:90 [&lt;ffffffff8147e708&gt;] msgctl_nolock.constprop.9+0x208/0x430 ipc/msg.c:480 [&lt; inline &gt;] SYSC_msgctl ipc/msg.c:538 [&lt;ffffffff8147f061&gt;] SyS_msgctl+0xa1/0xb0 ipc/msg.c:522 [&lt;ffffffff81ee3e11&gt;] entry_SYSCALL_64_fastpath+0x31/0x95 arch/x86/entry/entry_64.S:188 Previous write at 0xffff88047f810f68 of size 8 by thread 2755 on CPU 4: [&lt;ffffffff8147cf97&gt;] ipc_addid+0x217/0x260 ipc/util.c:257 [&lt;ffffffff8147eb4c&gt;] newque+0xac/0x240 ipc/msg.c:141 [&lt; inline &gt;] ipcget_public ipc/util.c:355 [&lt;ffffffff8147daa2&gt;] ipcget+0x202/0x280 ipc/util.c:646 [&lt; inline &gt;] SYSC_msgget ipc/msg.c:255 [&lt;ffffffff8147efaa&gt;] SyS_msgget+0x7a/0x90 ipc/msg.c:241 [&lt;ffffffff81ee3e11&gt;] entry_SYSCALL_64_fastpath+0x31/0x95 arch/x86/entry/entry_64.S:188 Mutexes locked by thread 2755: Mutex 445417 is locked here: [&lt;ffffffff81ee0d45&gt;] down_write+0x65/0x80 kernel/locking/rwsem.c:62 [&lt; inline &gt;] ipcget_public ipc/util.c:348 [&lt;ffffffff8147d90c&gt;] ipcget+0x6c/0x280 ipc/util.c:646 [&lt; inline &gt;] SYSC_msgget ipc/msg.c:255 [&lt;ffffffff8147efaa&gt;] SyS_msgget+0x7a/0x90 ipc/msg.c:241 [&lt;ffffffff81ee3e11&gt;] entry_SYSCALL_64_fastpath+0x31/0x95 arch/x86/entry/entry_64.S:188 Mutex 453634 is locked here: [&lt; inline &gt;] __raw_spin_lock include/linux/spinlock_api_smp.h:158 [&lt;ffffffff81ee37d0&gt;] _raw_spin_lock+0x50/0x70 kernel/locking/spinlock.c:151 [&lt; inline &gt;] spin_lock include/linux/spinlock.h:312 [&lt;ffffffff8147ce0e&gt;] ipc_addid+0x8e/0x260 ipc/util.c:238 [&lt;ffffffff8147eb4c&gt;] newque+0xac/0x240 ipc/msg.c:141 [&lt; inline &gt;] ipcget_public ipc/util.c:355 [&lt;ffffffff8147daa2&gt;] ipcget+0x202/0x280 ipc/util.c:646 [&lt; inline &gt;] SYSC_msgget ipc/msg.c:255 [&lt;ffffffff8147efaa&gt;] SyS_msgget+0x7a/0x90 ipc/msg.c:241 [&lt;ffffffff81ee3e11&gt;] entry_SYSCALL_64_fastpath+0x31/0x95 arch/x86/entry/entry_64.S:188 ipc_addid installs new ipc object with idr_alloc, from this point on it is accessible to other threads. At this point the object contains unitialized garbage. Then it fills in uid, etc: new-&gt;cuid = new-&gt;uid = euid; new-&gt;gid = new-&gt;cgid = egid; new-&gt;seq = ids-&gt;seq++; While this happens another thread can get access to the object and do uid check on the unitialized garbage, which can give falsely give accesses to the shared object to a process that should not have access to the object. Upstream patch: <a href="https://github.com/torvalds/linux/commit/b9a532277938">https://github.com/torvalds/linux/commit/b9a532277938</a> CVE assignment: <a href="http://seclists.org/oss-sec/2015/q4/7">http://seclists.org/oss-sec/2015/q4/7</a>

Credit: cve@mitre.org cve@mitre.org cve@mitre.org

Affected SoftwareAffected VersionHow to fix
Linux Linux kernel<=4.2.3
Linux Linux kernel<3.2.72
Linux Linux kernel>=3.3<3.4.111
Linux Linux kernel>=3.5<3.10.91
Linux Linux kernel>=3.11<3.12.50
Linux Linux kernel>=3.13<3.14.55
Linux Linux kernel>=3.15<3.16.35
Linux Linux kernel>=3.17<3.18.23
Linux Linux kernel>=3.19<4.1.11
Linux Linux kernel>=4.2<4.2.4
debian/linux
5.10.223-1
5.10.226-1
6.1.115-1
6.1.119-1
6.11.10-1

Remedy

https://git.kernel.org/linus/1da177e4c3f41524e886b7f1b8a0c1fc7321cac2

Remedy

https://git.kernel.org/linus/b9a532277938798b53178d5a66af6e2915cb27cf

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the vulnerability ID for this vulnerability?

    The vulnerability ID for this vulnerability is CVE-2015-7613.

  • What is the severity of CVE-2015-7613?

    The severity of CVE-2015-7613 is high, with a severity value of 7.

  • How does CVE-2015-7613 affect Linux kernel?

    CVE-2015-7613 affects the Linux kernel through version 4.2.3.

  • How can local users gain privileges through CVE-2015-7613?

    Local users can gain privileges through CVE-2015-7613 by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data.

  • Is there a fix available for CVE-2015-7613?

    Yes, there are fixes available for CVE-2015-7613. Please refer to the provided references for more information.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203