Last updated 24 July 2024

Description of problem: Upstream commit dab5855 ("perfcounter: Add mmap event hooks to mprotect()") is fundamentally wrong as mprotectfixup() can free 'vma' due to merging. Fix the problem by moving perfeventmmap() hook to mprotectfixup(). In certain scenario, a local, unprivileged user could use this flaw to trigger a denial of service.

Upstream commit: http://git.kernel.org/linus/63bfd7384b119409685a17d5c58f0b56e5dc03da

By submitting certain I/O requests with 0 length, a local user could cause a kernel panic.

Proposed patch: http://git.kernel.org/?p=linux/kernel/git/axboe/linux-2.6-block.git;a=commit;h=9284bcf4e335e5f18a8bc7b26461c33ab60d0689

Acknowledgements:

Red Hat would like to thank Dan Rosenberg for reporting this issue.

Due to integer underflow and overflow issues when determining the number of pages required for maliciously crafted I/O requests, a local user could send a device ioctl that results in the sequential allocation of a very large number of pages, causing the OOM killer to be invoked and crashing the system:

Proposed patch: http://git.kernel.org/?p=linux/kernel/git/axboe/linux-2.6-block.git;a=commit;h=cb4644cac4a2797afc847e6c92736664d4b0ea34

Acknowledgements:

Red Hat would like to thank Dan Rosenberg for reporting this issue.

Last updated 24 July 2024

Description of problem: gdthioctlalloc() takes the size variable as an int. copyfromuser() takes the size variable as an unsigned long. gen.datalen and gen.senselen are unsigned longs. On x8664 longs are 64 bit and ints are 32 bit.

We could pass in a very large number and the allocation would truncate the size to 32 bits and allocate a small buffer. Then when we do the copyfromuser(), it would result in a memory corruption.

Reference: http://ns3.spinics.net/lists/linux-scsi/msg47361.html

Upstream: http://git.kernel.org/linus/f63ae56e4e97fb12053590e41a4fa59e7daa74a4

Description of problem: In bcmconnect() (in net/can/bcm.c), there is the following code:

sprintf(bo->procname, "%p", sock);

"procname" is a 9-byte char array. On 64-bit platforms, up to 17 bytes may be copied into the buffer. Fortunately, structure padding will most likely prevent this from being a problem, except for the trailing NULL byte, which may overwrite the first byte of the next heap object.

Reference: http://www.spinics.net/lists/netdev/msg145791.html

Acknowledgements:

Red Hat would like to thank Dan Rosenberg for reporting this issue.

Description of problem: Reported by Nelson Elhage.

CVE-2010-3848 AFECONET kernel stack overflow CVE-2010-3849 AFECONET saddr->cookie NULL dereferences CVE-2010-3850 AFECONET SIOCSIFADDR ioctl does not check privileges

The two main vulnerabilities lie in the econetsendmsg() function. If CONFIGECONETAUNUDP, the function declares a variable-length array of iovec's on the stack:

static int econetsendmsg(struct kiocb iocb, struct socket sock, struct msghdr msg, sizet len) { ... #ifdef CONFIGECONETAUNUDP ... struct iovec iov[msg->msgiovlen+1]; ... #endif

"msg->msgiovlen" is a user-controlled value <= 1024; 1024 'struct iovec's is enough to overflow the kernel stack and clobber the 'threadinfo' struct on either 32- or 64-bit systems with or without CONFIG4KSTACKS.

The code populates 'iov' with user-controlled values, so this is almost certainly exploitable for privesc.

The second bug is conveniently labeled as such for anyone who cares to look:

/ BUG: saddr may be NULL / eb->cookie = saddr->cookie;

In fact, 'saddr' comes from userspace and may be NULL (if non-NULL, it will have been copied to kernelspace), leading to a NULL-pointer dereference. This saddr->cookie dereference appears twice, once in the "hardware" case and once in the "UDP emulation" case. This is easily exploitable for an oops, but probably not anything more.

The final issue is in the ecdevioctl function. The SIOCSIFADDR ioctl does not check privileges, allowing an unprivileged user to assign econet addresses to arbitrary interfaces. It is possible this is intentional, but AFAIK it would be unusual for SIOCSIFADDR to be unprivileged, so this may be an accident.

Note that it is necessary to use this property in order to make the first two bugs exploitable, since econetsendmsg will return almost immediately if no econet addresses are configured.

Reference: http://seclists.org/oss-sec/2010/q4/236

Description of problem: The PKTCTRLCMDSTATUS device ioctl retrieves a pointer to a pktcdvddevice from the global pktdevs array. The index into this array is provided directly by the user and is a signed integer, so the comparison to ensure that it falls within the bounds of this array will fail when provided with a negative index.

This can be used to read arbitrary kernel memory or cause a crash due to an invalid pointer dereference. This can be exploited by users with permission to open /dev/pktcdvd/control (on many distributions, this is readable by group "cdrom").

Upstream commit: http://git.kernel.org/linus/252a52aa4fa22a668f019e55b3aac3ff71ec1c29

Description of problem: The sndctlnew() function in sound/core/control.c allocates space for a sndkcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC device (on many distros, this is group "audio") via the SNDRVCTLIOCTLELEMADD and SNDRVCTLIOCTLELEMREPLACE ioctls.

Upstream commit: http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git;a=commitdiff;h=5591bf07225523600450edd9e6ad258bb877b779

Acknowledgements:

Red Hat would like to thank Dan Rosenberg for reporting this issue.

Last updated 24 July 2024

Description of problem: This doesn't look correct, the iosubmit systemcall calls doiosubmit() directly:

SYSCALLDEFINE3(iosubmit, aiocontextt, ctxid, long, nr, struct iocb user user , iocbpp) { return doiosubmit(ctxid, nr, iocbpp, 0); }

doiosubmit only checks if nr < 0, but doesnt check if the accessok multiplication will overflow.

long doiosubmit(aiocontextt ctxid, long nr, struct iocb user user iocbpp, bool compat) { ... if (unlikely(!accessok(VERIFYREAD, iocbpp, (nrsizeof(iocbpp))))) return -EFAULT; ...

Then it uses this loop with getusernocheck(), which doesn't look safe.

... for (i=0; i<nr; i++) { struct iocb user useriocb; struct iocb tmp;

if (unlikely(getuser(useriocb, iocbpp + i))) { ret = -EFAULT; break; } ...

Acknowledgements:

Red Hat would like to thank Tavis Ormandy for reporting this issue.

Reported by Dave Jones, currently we have:

--w--w--w-. 1 root root 0 2010-11-11 14:56 /sys/kernel/debug/acpi/custommethod

which is just crazy. Change this to --w-------.

This custommethod file allows to inject custom ACPI methods into the ACPI interpreter tables. This control file was introduced with world writeable permissions in Linux Kernel 2.6.33.

Introduced in: http://git.kernel.org/linus/a1a541d86f50a9957beeedb122a035870d602647 http://git.kernel.org/linus/a25ee9200eef07377e1703697afbb5d81f89e500

Fixed in: http://git.kernel.org/linus/ed3aada1bf34c5a9e98af167f125f8a740fc726a