[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Mon, 25 Nov 2013 17:17:18 -0800 (PST)
From: Ramon de C Valle <rdecvalle@...are.com>
To: oss-security@...ts.openwall.com
Subject: Re: CVE request: Kernel MSM - Memory leak in
drivers/base/genlock.c
----- Original Message -----
> From: "Steven M. Christey" <coley@...re.org>
> To: oss-security@...ts.openwall.com
> Sent: Monday, November 25, 2013 10:57:23 PM
> Subject: RE: [oss-security] CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c
>
> Kurt said:
>
> >> The Genlock driver does not properly initialize all members of a
> >> structure before copying it to user space. This allows a local
> >> attacker to obtain potentially sensitive information from kernel
> >> stack memory via ioctl system calls.
> >
> >This should be classified as CWE-200 Information Disclosure, "memory
> >leak" refers to memory being used and not released properly, resulting
> >in out of memory conditions.
>
> In CWE, we discourage the "memory leak" term because it has multiple meanings
> and interpretations: (1) that memory is allocated but never released, or (2)
> that sensitive portions of memory are accidentally disclosed to untrusted
> parties.
>
> This request sounds like variant (2) of the varying uses of the "memory leak"
> term, although Kurt's interpretation seems to be that it's about variant
> (1), which further reinforces my personal desire to see that term go away
> forever.
>
> Anyway... Note that, as this issue is described, "information disclosure"
> actually results from a root cause in which certain locations are not
> properly initialized. Thus CWE-665: Improper Initialization (or its child
> CWE-457 Use of Uninitialized Variable) are probably more appropriate
> characterizations of the core issue; in this case, it happens to lead to
> memory disclosure, but in other cases, it might lead to privilege escalation
> or other consequences (depending on how the uninitialized data is used.)
I'd rather use "Missing Initialization of Resource (CWE-909)" to "Use of Uninitialized Resource (CWE-908)" to describe the chain of primary weaknesses. Although CWE-665 and CWE-909 seem very similar, even the examples—do we have a duplicate?
>
> Note that vulnerabilities can be combinations of 2 or more less-significant
> errors, which in CWE are called chains or composites:
> http://cwe.mitre.org/data/reports/chains_and_composites.html
>
> That is, just like there can be attack chains, there can be vulnerability
> chains.
>
> As vulnerabilities become more and more complex (because the easy stuff is
> slowly getting eliminated), chains and composites are likely to pose more
> and more challenges for vulnerability classification in the future. The
> Linux kernel is one of those places.
>
> For CVE assignment purposes, we generally try to classify based on the root
> cause, but there is a recognition that opinions may vary widely in this
> area.
>
> - Steve
>
--
Ramon de C Valle
VMware (vSECR) Security Engineering Team
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
