Home page logo
/

oss-sec logo oss-sec mailing list archives

Re: CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c
From: Ramon de C Valle <rdecvalle () vmware com>
Date: Mon, 25 Nov 2013 17:17:18 -0800 (PST)



----- Original Message -----
From: "Steven M. Christey" <coley () mitre org>
To: oss-security () lists openwall com
Sent: Monday, November 25, 2013 10:57:23 PM
Subject: RE: [oss-security] CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c

Kurt said:

The Genlock driver does not properly initialize all members of a
structure before copying it to user space. This allows a local
attacker to obtain potentially sensitive information from kernel
stack memory via ioctl system calls.

This should be classified as CWE-200 Information Disclosure, "memory
leak" refers to memory being used and not released properly, resulting
in out of memory conditions.

In CWE, we discourage the "memory leak" term because it has multiple meanings
and interpretations: (1) that memory is allocated but never released, or (2)
that sensitive portions of memory are accidentally disclosed to untrusted
parties.

This request sounds like variant (2) of the varying uses of the "memory leak"
term, although Kurt's interpretation seems to be that it's about variant
(1), which further reinforces my personal desire to see that term go away
forever.

Anyway... Note that, as this issue is described, "information disclosure"
actually results from a root cause in which certain locations are not
properly initialized.  Thus CWE-665: Improper Initialization (or its child
CWE-457 Use of Uninitialized Variable) are probably more appropriate
characterizations of the core issue; in this case, it happens to lead to
memory disclosure, but in other cases, it might lead to privilege escalation
or other consequences (depending on how the uninitialized data is used.)
I'd rather use "Missing Initialization of Resource (CWE-909)" to "Use of Uninitialized Resource (CWE-908)" to describe 
the chain of primary weaknesses. Although CWE-665 and CWE-909 seem very similar, even the examples—do we have a 
duplicate?


Note that vulnerabilities can be combinations of 2 or more less-significant
errors, which in CWE are called chains or composites:
http://cwe.mitre.org/data/reports/chains_and_composites.html

That is, just like there can be attack chains, there can be vulnerability
chains.

As vulnerabilities become more and more complex (because the easy stuff is
slowly getting eliminated), chains and composites are likely to pose more
and more challenges for vulnerability classification in the future.  The
Linux kernel is one of those places.

For CVE assignment purposes, we generally try to classify based on the root
cause, but there is a recognition that opinions may vary widely in this
area.

- Steve


-- 
Ramon de C Valle
VMware (vSECR) Security Engineering Team


  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]