Date: Fri, 9 May 2014 09:13:30 +0200 From: Marcus Meissner <meissner@...e.de> To: OSS Security List <oss-security@...ts.openwall.com> Cc: mattd@...fuzz.com Subject: Linux kernel floppy ioctl kernel code execution Hi, As this was posted to linux-distros, and was supposed to be made public earlier this week, but so far wasn't published on oss-sec ... Reported by Matthew Daley to security@...nel.org. There apparently exists a proof of concept root exploit, that allows local users with access to a floppy device to execute code in the linux kernel. (I think this needs a floppy driver to actually allow access to a floppy device. My machine only says "floppy0: no floppy controllers found" today.) Linux Kernel Mainline commits: 2145e15e0557a01b9195d1c7199a1b92cb9be81f Author: Matthew Daley <mattd@...fuzz.com> Date: Mon Apr 28 19:05:21 2014 +1200 floppy: don't write kernel-only members to FDRAWCMD ioctl output Do not leak kernel-only floppy_raw_cmd structure members to userspace. This includes the linked-list pointer and the pointer to the allocated DMA space. Signed-off-by: Matthew Daley <mattd@...fuzz.com> References: CVE-2014-1738 Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org> commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c Author: Matthew Daley <mattd@...fuzz.com> Date: Mon Apr 28 19:05:20 2014 +1200 floppy: ignore kernel-only members in FDRAWCMD ioctl input Always clear out these floppy_raw_cmd struct members after copying the entire structure from userspace so that the in-kernel version is always valid and never left in an interdeterminate state. Signed-off-by: Matthew Daley <mattd@...fuzz.com> References: CVE-2014-1737 Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org> Ciao, Marcus
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.