Date: Thu, 6 Nov 2014 23:50:44 +0100 From: Robert Święcki <robert@...ecki.net> To: oss-security@...ts.openwall.com Subject: Exploitable issues in Linux perf/ftrace subsystems 1. Perf subsystem oob read in supervisor mode (local DoS) - CVE-2014-7825 ===================================================================== The syscall_nr variable is not verified against the upper limit (NR_syscalls) in the perf_syscall_enter()/perf_syscall_exit() functions, making it possible for the subsequent test_bit() function to fail when trying to access non-present memory pages. http://lxr.free-electrons.com/source/kernel/trace/trace_syscalls.c?v=3.16#L569 The impact of this bug depends on the value of kernel.panic_on_oops sysctl. When equal to 1, it becomes local DoS. For other values it can still aid an attacker with mapping the kernel address space layout under systems with kASLR enabled. This issue has been fixed with in the kernel's mainline tree with: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/kernel/trace/trace_syscalls.c?id=086ba77a6db00ed858ff07451bedee197df868c9 Author: Rabin Vincent <rabin@....in> Date: Wed Oct 29 23:06:58 2014 +0100 2. Ftrace subsystem supervisor mode code execution - CVE-2014-7826 ===================================================================== As a precondition this attack scenario requires system administrators to enable ftrace-level system tracing (e.g. with 'trace-cmd record -e syscalls:sys_enter_write' command) on the local system, at the time of attack taking place. Likewise, the problem stems from an incorrect upper boundary check of the syscall_nr variable inside ftrace_syscall_enter()/ftrace_syscall_exit() functions. However, unlike with CVE-2014-7825, here a user-controlled pointer inside the 'struct ftrace_event_file' structure can be called through the ftrace_trigger_soft_disabled() -> event_triggers_call() function call-chain (http://lxr.free-electrons.com/source/kernel/trace/trace_events_trigger.c#L77) leading to supervisor mode code execution of user-controlled code (under systems w/o SMEP/SMAP-type protections enabled). This issue has been fixed with the same patch: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/kernel/trace/trace_syscalls.c?id=086ba77a6db00ed858ff07451bedee197df868c9 Author: Rabin Vincent <rabin@....in> Date: Wed Oct 29 23:06:58 2014 +0100 3. Misc ===================================================================== These issues were independetly discovered by Rabin Vincent and Robert Swiecki, and the exploitation scenarios were independently developed by Russell King and Robert Swiecki
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.