[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAP145phaiadcmPLpeFMS6Gs5iWKXex1iM0qKamrVEWs0oNaTpw@mail.gmail.com>
Date: Thu, 6 Nov 2014 23:50:44 +0100
From: Robert Święcki <robert@...ecki.net>
To: oss-security@...ts.openwall.com
Subject: Exploitable issues in Linux perf/ftrace subsystems
1. Perf subsystem oob read in supervisor mode (local DoS) - CVE-2014-7825
=====================================================================
The syscall_nr variable is not verified against the upper limit
(NR_syscalls) in the perf_syscall_enter()/perf_syscall_exit()
functions, making it possible for the subsequent test_bit() function
to fail when trying to access non-present memory pages.
http://lxr.free-electrons.com/source/kernel/trace/trace_syscalls.c?v=3.16#L569
The impact of this bug depends on the value of kernel.panic_on_oops
sysctl. When equal to 1, it becomes local DoS. For other values it can
still aid an attacker with mapping the kernel address space layout
under systems with kASLR enabled.
This issue has been fixed with in the kernel's mainline tree with:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/kernel/trace/trace_syscalls.c?id=086ba77a6db00ed858ff07451bedee197df868c9
Author: Rabin Vincent <rabin@....in>
Date: Wed Oct 29 23:06:58 2014 +0100
2. Ftrace subsystem supervisor mode code execution - CVE-2014-7826
=====================================================================
As a precondition this attack scenario requires system administrators
to enable ftrace-level system tracing (e.g. with 'trace-cmd record -e
syscalls:sys_enter_write' command) on the local system, at the time of
attack taking place. Likewise, the problem stems from an incorrect
upper boundary check of the syscall_nr variable inside
ftrace_syscall_enter()/ftrace_syscall_exit() functions. However,
unlike with CVE-2014-7825, here a user-controlled pointer inside the
'struct ftrace_event_file' structure can be called through the
ftrace_trigger_soft_disabled() -> event_triggers_call() function
call-chain (http://lxr.free-electrons.com/source/kernel/trace/trace_events_trigger.c#L77)
leading to supervisor mode code execution of user-controlled code
(under systems w/o SMEP/SMAP-type protections enabled).
This issue has been fixed with the same patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/kernel/trace/trace_syscalls.c?id=086ba77a6db00ed858ff07451bedee197df868c9
Author: Rabin Vincent <rabin@....in>
Date: Wed Oct 29 23:06:58 2014 +0100
3. Misc
=====================================================================
These issues were independetly discovered by Rabin Vincent and Robert
Swiecki, and the exploitation scenarios were independently developed
by Russell King and Robert Swiecki
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
