Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date: Thu, 6 Jun 2013 13:59:55 -0700
From: Kees Cook <keescook@...omium.org>
To: oss-security@...ts.openwall.com
Subject: Linux kernel format string flaws

I've found two issues in how Linux uses format strings:


CVE-2013-2852: b43 wireless driver

The b43 driver reports error strings that can be interpreted as format
strings. Under normal conditions, this is not a problem, but it is
possible for the "fwpostfix" module parameter to change the filenames
used to fetch firmware. When such a file is not found, the filename
will be processed as a format string. This flaw could potentially allow
escalation from uid-0 to ring-0, so except for certain environments,
it is not too serious.

If b43 hardware is available, this should show itself easily. I don't have
any available for testing, but it seems it would show itself like this:
# rmmod b43
# modprobe b43 fwpostfix=AA%xBB
...
# dmesg
...
b43-0 ERROR: Firmware file "b43AAdeff80ccBB/a0g1bsinitvals5.fw" not found

Using %n instead of %x would lead to exciting crashes. :)

It has been fixed in the upstream wireless tree:

http://git.kernel.org/cgit/linux/kernel/git/linville/wireless.git/commit/?id=9538cbaab6e8b8046039b4b2eb6c9d614dc782bd


CVE-2013-2851: block layer

The block layer uses the "disk_name" field as a format
string in a number of places. While this is normally not a problem due
to how disk names are created (statically or incrementally), there
is currently at least one way to define nearly arbitrary names via
md. Instead of filtering md, this should be fixed within the kernel's
interfaces. This flaw could potentially allow escalation from uid-0 to
ring-0, so except for certain environments, it is not too serious.

The test case is trivial:
# echo md_%x.%x.%x.%x > /sys/module/md_mod/parameters/new_array
# ls /dev/md_*
/dev/md_c12cc370.df66d800.df66d80c.c13da45b

Using %n instead of %x leads to exciting crashes. :)

The fix has been sent upstream:
http://marc.info/?l=linux-kernel&m=137055204522556&w=2


With the above fixes, a series of additional format string related clean
ups has also been sent upstream:
http://marc.info/?l=linux-kernel&m=137055207522563&w=2


Thanks,

-Kees

-- 
Kees Cook
Chrome OS Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.