Date: Mon, 29 Nov 2010 20:05:18 -0500 From: Nelson Elhage <nelhage@...lice.com> To: oss-security@...ts.openwall.com Subject: kernel: Multiple vulnerabilities in AF_ECONET I reported these recently, and they were fixed upstream last week. CVE-2010-3848: Kernel stack overflow in econet_sendmsg CVE-2010-3849: NULL pointer dereference in PF_ECONET CVE-2010-3850: Missing check for capable(CAP_NET_ADMIN) in econet SIOCSIFADDR CVE-2010-3848 is interesting because it's a bug class I haven't seen before, although maybe people who have been around longer have. econet_sendmsg() can be made to allocate > 8192 bytes on the kernel stack, overflowing the two pages allocated for the stack, and allowing an attacker to clobber the 'struct thread_info', which provides several easy exploit vectors. Jon Oberheide has done a more detailed writeup about this bug class here: http://jon.oberheide.org/blog/2010/11/29/exploiting-stack-overflows-in-the-linux-kernel/ CVE-2010-3850 is mostly interesting because without it, there is no way an unprivileged user can trigger the first two bugs unless an administrator has already configured an econet address somewhere (econet_sendmsg fails quickly if there are no econet addresses configured on the system). Reference: http://www.debian.org/security/2010/dsa-2126 Upstream commits: CVE-2010-3848: http://git.kernel.org/linus/a27e13d370415add3487949c60810e36069a23a6 CVE-2010-3849: http://git.kernel.org/linus/fa0e846494792e722d817b9d3d625a4ef4896c96 CVE-2010-3850: http://git.kernel.org/linus/16c41745c7b92a243d0874f534c1655196c64b74 - Nelson
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.