Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 15 Oct 2013 18:44:58 +0100
From: Jonathan Salwan <jonathan.salwan@...il.com>
To: oss-security@...ts.openwall.com
Subject: Report - Stack-based buffer overflow and memory disclosure in camera
 driver (CVE-2013-4748 CVE-2013-4739)

Source: https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-and-memory-disclosure-camera-driver-cve-2013-4748-cve-2013-4739



Description

A stack-based buffer overflow and a kernel memory disclosure
vulnerability have been discovered in the system call handlers of the
camera driver.

CVE-2013-4738:
The camera post processing engine (CPP) and video processing engine
(VPE) provide an ioctl system call interface to user space clients for
communication. When processing arguments passed to the
VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO or
VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl subdev handlers, a user
space supplied length value is used to copy memory to a local stack
buffer without proper bounds checking. An application with access to
the respective device nodes can use this flaw to, e.g., elevate
privileges.

Access Vector: local
Security Risk: high
Vulnerability: CWE-121 (stack-based buffer overflow)

CVE-2013-4739:
The Gemini JPEG encoder and the Jpeg1.0 common encoder/decoder engines
of the camera driver are not properly initializing all members of a
structure before copying it to user space. This allows a local
attacker to obtain potentially sensitive information from kernel stack
memory via ioctl system calls.

Access Vector: local
Security Risk: low
Vulnerability: CWE-200 (information exposure)

Affected versions
All Android releases from CAF using a Linux kernel from the following heads:

msm-3.4
jb_3*

Patch

We advise customers to apply the following patches:

CVE-2013-4738:

https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=c9c81836ee44db9974007d34cf2aaeb1a51a8d45
https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=28385b9c3054c91dca1aa194ffa750550c50f3ce

CVE-2013-4739:

https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8604847927f952cc8e773b97eca24e1060a570f2

Acknowledgement

Qualcomm Innovation Center, Inc. (QuIC) thanks Jonathan Salwan of the
Sysdream Security Lab for reporting the related issues and working
with QuIC to help improve Android device security.

Revisions

Initial revision

Contact
security-advisory@...cinc.com


-- Jonathan

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Powered by Openwall GNU/*/Linux - Powered by OpenVZ