Date: Mon, 1 Aug 2016 19:49:02 -0400 (EDT) From: cve-assign@...re.org To: sbauer@...donthack.me Cc: cve-assign@...re.org, oss-security@...ts.openwall.com Subject: Re: CVE Request: Linux >= 4.5 double fetch leading to heap overflow -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 > Some code was moved from btrfs to the generic vfs ioctl: > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/fs/ioctl.c?h=v4.5&id=54dbc15172375641ef03399e8f911d7165eb90fb > > During the port a double fetch with userland was introduced which can lead to an undersized allocation and subsequent heap overflow > with potentially controlled data. It has been patched in upstream here: > > https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=10eec60ce79187686e052092e5383c99b4420a20 >> vfs: ioctl: prevent double-fetch in dedupe ioctl >> >> This prevents a double-fetch from user space that can lead to to an >> undersized allocation and heap overflow. > I attempted to write an exploit for this but that's not really my forte. I feel like this bug > has the potential for a workable user->root exploit but I couldn't do it. > > 1: You can control which cache the overflow happens on. I picked the same cache as the File struct. > 2: the code writes 2 different width zeros past the allocation, one 32 bit and the other 64 bit. > 3: I attempted to overflow and write the 32 bit 0 to the top half of a pointer so it would point to userland, > but I couldn't find a suitable structure to overflow into. > pthread_create(&race_car, NULL, size_change, range); Use CVE-2016-6516. - -- CVE Assignment Team M/S M300, 202 Burlington Road, Bedford, MA 01730 USA [ A PGP key is available for encrypted communications at http://cve.mitre.org/cve/request_id.html ] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAEBCAAGBQJXn97QAAoJEHb/MwWLVhi2cCAP/2C+AHkxRISZ5YCq50+Vvj5d iLeqbqdcrdI8yfdPNL6k9QpH8VL1SOtiofxXaySHU7Fde1eh2IRTtLq2jbYpPhhP YOqkc2kaZvkboRrVVacm4nUko1WfMlzfGUsd48GALKvlzHRPxlxhAIx3we/2+YwD gZWUDITE5zQiN4ShbsUGdTMVkQYUzIYEhYD7w0o4kFmVKwTuq1w0GZQsvq56df3x IL2rhmEq7YtK3uCMQrFFZKlvUcDWke5ri9pu9D7YoDkOVM2aMLivA/FMN1y2Blbt FdDUaqerMVZFgJl0PB1YIsnpdFpUliptCDsXcbRGOC2xsXAPSbNoAsoRlyZ7WrNJ wAX2F7e+WIj7MdArNaNeIUt5ltXh5KPVwpgjzV2Z+UwU6ySt/iRAy1eyONrqvJz0 hVxIYw2uGUu6hvHp/VslmLx9jeASZogESxlZYytUrgNFUnbRJFVeJHOPMf9kKcEk 8vg2mmwlOdC47AWsh3vWqTs5ap/lRYuK9urR1OvtJxY9sUbm1Fwv31O4BuySjQHy N0ScMNUXGvXkU2+v6CYOGq1eKojAXUN8pQRRpwmJvk/PmLZ0SNKaW/EdStDxTu4d Jd/Dqk8z6HpqbbdCQpPGBSPfMiAmGYMSPQbxyoYTgTZbC40u+4C+hJXJvC3iVvZ8 rXIC5MKykZB1QuBz5ecG =UAFW -----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.