Date: Fri, 5 Nov 2021 23:11:42 +0800 From: butt3rflyh4ck <butterflyhuangxx@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel: isdn: cpai: array-index-out-of-bounds in detach_capi_ctr in drivers/isdn/capi/kcapi.c Hi, the Mitre has assigned CVE-2021-43389 to this issue. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43389 Regards, butt3rflyh4ck. On Tue, Oct 19, 2021 at 11:21 PM butt3rflyh4ck <butterflyhuangxx@...il.com> wrote: > > Hi, there is an array-index-out-bounds bug in detach_capi_ctr in > drivers/isdn/capi/kcapi.c and I reproduce it on 5.15.0-rc2+. > > #Root Cause > we can call CMTPCONNADD ioctl and it would invoke > do_cmtp_sock_ioctl(), it would call cmtp_add_connection(). > The chain of call is as follows. > ioctl(CMTPCONNADD) > ->cmtp_sock_ioctl() > -->do_cmtp_sock_ioctl() > --->cmtp_add_connection() > ---->kthread_run() > ---->cmtp_attach_device() > the function would add a cmtp session to a controller. > > The cmtp_add_connection() would add a cmtp session to a controller > and run a kernel thread to process cmtp. > > __module_get(THIS_MODULE); > session->task = kthread_run(cmtp_session, session, "kcmtpd_ctr_%d", > session->num); > > During this process, the kernel thread would call detach_capi_ctr() > to detach a register controller. if the controller > was not attached yet, detach_capi_ctr() would > trigger an array-index-out-bounds bug. > > > #analyze > https://lore.kernel.org/netdev/CAFcO6XOvGQrRTaTkaJ0p3zR7y7nrAWD79r48=L_BbOyrK9X-vA@mail.gmail.com/ > > #patch > The patch is available upstream now. > https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=1f3e2e97c003f80c4b087092b225c8787ff91e4d > > #Timeline > *2021/9/24 - Vulnerability reported to netdev@...r.kernel.org. > *2021/9/24 - Vulnerability confirmed. > *2021/10/8 - Vulnerability patched. > *2021/10/9 - Vulnerability reported to secalert@...hat.com and confirmed > *2021/10/19 - Opened on oss-security@...ts.openwall.com. > > #Credit > Active Defense Lab of Venustech. > > > Regards, > butt3rflyh4ck. > > -- > Active Defense Lab of Venustech -- Active Defense Lab of Venustech
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.