Date: Sun, 15 Jun 2014 07:50:54 +0200 From: Salva Peiró <speiro@....upv.es> To: OSS Security List <oss-security@...ts.openwall.com> Subject: CVE-2014-1739: Kernel Infoleak vulnerability in,media_enum_entities() Hi, We found an infoleak vulnerability in the ioctl media_enum_entities() that allows to disclose 200 bytes the kernel process' stack. The vulnerability is exploitable on versions up to linux-3.15-rc3 by local users with read access to `/dev/media0`. Linux distributions ship with `chmod 600 /dev/media0` preventing unprivileged local users from exploiting the vulnerability. However, some Android devices are known to be shipped with both read and/or write permissions for all: chmod 666 /dev/media0. A detailed analysis, proof of concept and fixes are at: http://speirofr.appspot.com/cve-2014-1739-kernel-infoleak-vulnerability-in-media_enum_entities.html This has been fixed in Linux Kernel commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e6a623460e5fc960ac3ee9f946d3106233fd28d8 e6a623460e5fc960ac3ee9f946d3106233fd28d8 Author Salva Peiró <speiro@....upv.es> Date Thu, 1 May 2014 12:53:28 +0000 Commit [media] media-device: fix infoleak in ioctl media_enum_entities() This fixes CVE-2014-1739. Signed-off-by: Salva Peiró <speiro@....upv.es> Acked-by: Laurent Pinchart <laurent.pinchart@...asonboard.com> Cc: stable@...r.kernel.org Signed-off-by: Mauro Carvalho Chehab <m.chehab@...sung.com> Salva Peiró
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ