oss-security - CVE-2014-1739: Kernel Infoleak vulnerability in,media_enum

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <539D343E.5040105@ai2.upv.es>
Date: Sun, 15 Jun 2014 07:50:54 +0200
From: Salva Peiró <speiro@....upv.es>
To: OSS Security List <oss-security@...ts.openwall.com>
Subject: CVE-2014-1739: Kernel Infoleak vulnerability in,media_enum_entities()

Hi,

We found an infoleak vulnerability in the ioctl media_enum_entities()
that allows to disclose 200 bytes the kernel process' stack.
The vulnerability is exploitable on versions up to linux-3.15-rc3 by
local users with read access to `/dev/media0`.
Linux distributions ship with `chmod 600 /dev/media0` preventing
unprivileged local users from exploiting the vulnerability.
However, some Android devices are known to be shipped with both read
and/or write permissions for all: chmod 666 /dev/media0.

A detailed analysis, proof of concept and fixes are at:
http://speirofr.appspot.com/cve-2014-1739-kernel-infoleak-vulnerability-in-media_enum_entities.html

This has been fixed in Linux Kernel commit:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e6a623460e5fc960ac3ee9f946d3106233fd28d8

e6a623460e5fc960ac3ee9f946d3106233fd28d8
Author	Salva Peiró <speiro@....upv.es>
Date    Thu, 1 May 2014 12:53:28 +0000
Commit [media] media-device: fix infoleak in ioctl media_enum_entities()

    This fixes CVE-2014-1739.

    Signed-off-by: Salva Peiró <speiro@....upv.es>
    Acked-by: Laurent Pinchart <laurent.pinchart@...asonboard.com>
    Cc: stable@...r.kernel.org
    Signed-off-by: Mauro Carvalho Chehab <m.chehab@...sung.com>

Salva Peiró

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.