A data race that can trick the kernel into using initialized memory was found. This vulnerability can at least give access to arbitrary SysV shared memory. It is almost certain that this vulnerability can be used to gain arbitrary code execution in the kernel.
While working on KTSAN, Dmitry Vyukov got a report that says that ipcaddid() installs a not-completely initialized object into the shared object table. In particular, uid/gid are not initialized. ipcobtainobjectcheck() in turn obtains the object and verifies uid/gid for permission purposes. Since the fields are not initialized, the check can falsely succeed.
Race report:
ThreadSanitizer: data-race in ipcobtainobjectcheck
Read at 0xffff88047f810f68 of size 8 by thread 2749 on CPU 5: [<ffffffff8147d84d>] ipcobtainobjectcheck+0x7d/0xd0 ipc/util.c:621 [< inline >] msqobtainobjectcheck ipc/msg.c:90 [<ffffffff8147e708>] msgctlnolock.constprop.9+0x208/0x430 ipc/msg.c:480 [< inline >] SYSCmsgctl ipc/msg.c:538 [<ffffffff8147f061>] SySmsgctl+0xa1/0xb0 ipc/msg.c:522 [<ffffffff81ee3e11>] entrySYSCALL64fastpath+0x31/0x95 arch/x86/entry/entry64.S:188
Previous write at 0xffff88047f810f68 of size 8 by thread 2755 on CPU 4: [<ffffffff8147cf97>] ipcaddid+0x217/0x260 ipc/util.c:257 [<ffffffff8147eb4c>] newque+0xac/0x240 ipc/msg.c:141 [< inline >] ipcgetpublic ipc/util.c:355 [<ffffffff8147daa2>] ipcget+0x202/0x280 ipc/util.c:646 [< inline >] SYSCmsgget ipc/msg.c:255 [<ffffffff8147efaa>] SySmsgget+0x7a/0x90 ipc/msg.c:241 [<ffffffff81ee3e11>] entrySYSCALL64fastpath+0x31/0x95 arch/x86/entry/entry64.S:188
Mutexes locked by thread 2755: Mutex 445417 is locked here: [<ffffffff81ee0d45>] downwrite+0x65/0x80 kernel/locking/rwsem.c:62 [< inline >] ipcgetpublic ipc/util.c:348 [<ffffffff8147d90c>] ipcget+0x6c/0x280 ipc/util.c:646 [< inline >] SYSCmsgget ipc/msg.c:255 [<ffffffff8147efaa>] SySmsgget+0x7a/0x90 ipc/msg.c:241 [<ffffffff81ee3e11>] entrySYSCALL64fastpath+0x31/0x95 arch/x86/entry/entry64.S:188
Mutex 453634 is locked here: [< inline >] rawspinlock include/linux/spinlockapismp.h:158 [<ffffffff81ee37d0>] rawspinlock+0x50/0x70 kernel/locking/spinlock.c:151 [< inline >] spinlock include/linux/spinlock.h:312 [<ffffffff8147ce0e>] ipcaddid+0x8e/0x260 ipc/util.c:238 [<ffffffff8147eb4c>] newque+0xac/0x240 ipc/msg.c:141 [< inline >] ipcgetpublic ipc/util.c:355 [<ffffffff8147daa2>] ipcget+0x202/0x280 ipc/util.c:646 [< inline >] SYSCmsgget ipc/msg.c:255 [<ffffffff8147efaa>] SySmsgget+0x7a/0x90 ipc/msg.c:241 [<ffffffff81ee3e11>] entrySYSCALL64fastpath+0x31/0x95 arch/x86/entry/entry64.S:188
ipcaddid installs new ipc object with idralloc, from this point on it is accessible to other threads. At this point the object contains unitialized garbage. Then it fills in uid, etc:
new->cuid = new->uid = euid; new->gid = new->cgid = egid; new->seq = ids->seq++;
While this happens another thread can get access to the object and do uid check on the unitialized garbage, which can give falsely give accesses to the shared object to a process that should not have access to the object.
Upstream patch:
https://github.com/torvalds/linux/commit/b9a532277938
CVE assignment:
http://seclists.org/oss-sec/2015/q4/7
Florian Weimer of the Red Hat Product Security Team discovere that the mnlnlmsgportidok() function in libmnl 1.0.3 and earlier did not correctly validate the origin of a Netlink message, allowing local attackers to spoof Netlink messages, with context-dependent consequences.
Kernel panic is encountered when sctp stack receives duplicate asconf chunks.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b69040d8e39f20d5215a03502a8e8b4c6ab78395
An out-of-bounds memory access flaw, CVE-2014-7825, was found in the syscall tracing functionality of the Linux kernel's perf subsystem. A local, unprivileged user could use this flaw to crash the system. Additionally, an out-of-bounds memory access flaw, CVE-2014-7826, was found in the syscall tracing functionality of the Linux kernel's ftrace subsystem. On a system with ftrace syscall tracing enabled, a local, unprivileged user could use this flaw to crash the system, or escalate their privileges.
arch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel before 3.12 does not have an exit handler for the INVEPT instruction, which allows guest OS users to cause a denial of service (guest OS crash) via a crafted application.
Last updated 24 July 2024
Last updated 24 July 2024
Buffer overflow in the picolcdrawevent function in devices/hid/hid-picolcdcore.c in the PicoLCD HID device driver in the Linux kernel through 3.16.3, as used in Android on Nexus 7 devices, allows physically proximate attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a crafted device that sends a large report.
A buffer overflow is present in the method that the kernel uses to handle libceph auth tokens.
A flaw was found in the kernels handling of ceph authentication tickets.
The auth reply could be returned to a client unvalidated.
It was found that the Linux kernel's Infiniband subsystem did not properly sanitize input parameters while registering memory regions from the userspace via the (u)verbs API. As a result, an unrestricted physical memory access could be achieved.
A local user with access to /dev/infiniband/uverbsX could use this flaw to crash the system or, potentially, escalate their privileges on the system.
A flaw was found in the TIPC networking subsystem which could allow for memory corruption and possible priveledge escalation. The flaw involves a system with an unusually low MTU (60) on networking devices configured as bearers for the TIPC protocol. Not all devices support or allow MTU's below 68 octets.
An attacker can create a packet which will overwrite memory outside of allocated space and this can allow for priveledge escalation.
The affected code is not enabled on Red Hat Enterprise Linux 6 and 7. The affected code was not included in Red Hat Enterprise Linux 5.
Initial patch: https://www.mail-archive.com/netdev@vger.kernel.org/msg133205.html
journalunmapbuffer()'s zapbuffer: code clears a lot of buffer head state ala discardbuffer(), but does not touch Delay or Unwritten as discardbuffer() does.
This can be problematic in some areas of the ext4 code which assume that if they have found a buffer marked unwritten or delay, then it's a live one. They do not check whether a buffer is mapped, so jbd2's partial teardown can be problematic if they assume that this buffer head is still valid.
(Mounting without a journal also avoids the bug, because with no journal we go to unmapbuffer(), which does the right thing).
An unprivileged local user could use this flaw to crash the system.
Datalen paremeter of sockallocsendpskb() function is not validated before setting frags of allocated skb, which can lead to heap overflow.
On Red Hat Enterprise Linux 5 a user having access to TUN/TAP virtual device could use this flaw to crash the system or to potentially escalate their privileges. The resulting CVSS score is 6.2.
On Red Hat Enterprise Linux 6 a privileged guest user could use this flaw to crash the host or to potentially escalate their privileges on the host. The resulting CVSS score is 7.4.
Buffer overflow in virt/kvm/irqcomm.c in the KVM subsystem in the Linux kernel before 3.2.24 allows local users to cause a denial of service (crash) and possibly execute arbitrary code via vectors related to Message Signaled Interrupts (MSI), irq routing entries, and an incorrect check by the setuproutingentry function before invoking the kvmsetirq function.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Description of the problem: On 32-bit systems, a large args->buffercount from userspace via ioctl may overflow the allocation size, leading to out-of-bounds access.
References: http://www.openwall.com/lists/oss-security/2012/05/21/1
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=ed8cd3b2cd61004cab85380c52b1817aca1ca49b
Description of the problem: On 32-bit systems, a large args->numcliprects from userspace via ioctl may overflow the allocation size, leading to out-of-bounds access.
References: http://www.openwall.com/lists/oss-security/2012/05/21/1
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=44afb3a04391a74309d16180d1e4f8386fdfa745
In some cases it may happen that pmdnoneorclearbad() is called with the mmapsem hold in read mode. In those cases the huge page faults can allocate hugepmds under pmdnoneorclearbad() and that can trigger a false positive from pmdbad() that will not like to see a pmd materializing as trans huge.
A privileged user in the KVM guest can use this flaw to crash the host. An unprivileged local user could use this flaw to crash the system.
Proposed upstream patch: http://comments.gmane.org/gmane.linux.kernel.mm/75413
Florian Weimer of the Red Hat Product Security Team discovered that hypervkvpd would exit when it processed a spoofed Netlink packet that had been sent from an untrusted local user, in the following code:
len = recvfrom(fd, kvprecvbuffer, sizeof(kvprecvbuffer), 0, addrp, &addrl);
if (len < 0 || addr.nlpid) { syslog(LOGERR, "recvfrom failed; pid:%u error:%d %s", addr.nlpid, errno, strerror(errno)); close(fd); return -1; }
Acknowledgements:
This issue was discovered by Florian Weimer of the Red Hat Product Security Team.
Last updated 24 July 2024
A NULL pointer dereference flaw has been found in the way a new node's hot-added memory is propagated to other nodes zonelists. An unprivileged local user can use this flaw to crash the system.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commitdiff;h=08dff7b7d629807dbb1f398c68dd9cd58dd657a1
arch/x86/include/asm/pgtable.h in the Linux kernel before 3.6.2, when transparent huge pages are used, does not properly support PROTNONE memory regions, which allows local users to cause a denial of service (system crash) via a crafted application.
A memory disclosure flaw has been found in the way binfmtscript loadscript() function handled excessive recursions. An unprivileged local user could use this flaw to leak kernel memory.
References: - http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/ - https://lkml.org/lkml/2012/8/18/75
Proposed upstream fix: - https://lkml.org/lkml/2012/9/23/29
Last updated 24 July 2024