Full Disclosure mailing list archives
[TKADV2008-007] Linux Kernel SCTP-AUTH API Information Disclosure Vulnerability and NULL Pointer Dereferences
From: Tobias Klein <tk () trapkit de>
Date: Thu, 11 Sep 2008 09:27:26 +0200
Please find attached a detailed advisory of the vulnerabilities. Alternatively, the advisory can also be found at: http://www.trapkit.de/advisories/TKADV2008-007.txt
ÿþ- - - - - B E G I N P G P S I G N E D M E S S A G E - - - - -
H a s h : S H A 1
A d v i s o r y : L i n u x K e r n e l S C T P - A U T H A P I
I n f o r m a t i o n D i s c l o s u r e
V u l n e r a b i l i t y a n d N U L L P o i n t e r
D e r e f e r e n c e s
A d v i s o r y I D : T K A D V 2 0 0 8 - 0 0 7
R e v i s i o n : 1 . 1
R e l e a s e D a t e : 2 0 0 8 / 0 9 / 0 9
L a s t M o d i f i e d : 2 0 0 8 / 0 9 / 1 0
D a t e R e p o r t e d : 2 0 0 8 / 0 8 / 2 0
A u t h o r : T o b i a s K l e i n ( t k a t t r a p k i t . d e )
A f f e c t e d S o f t w a r e : L i n u x K e r n e l < = 2 . 6 . 2 6 . 4
R e m o t e l y E x p l o i t a b l e : N o
L o c a l l y E x p l o i t a b l e : Y e s
V e n d o r U R L : h t t p : / / w w w . k e r n e l . o r g /
V e n d o r S t a t u s : V e n d o r h a s r e l e a s e d a f i x e d v e r s i o n
C V E - I D : C V E - 2 0 0 8 - 3 7 9 2
P a t c h d e v e l o p m e n t t i m e : 1 d a y
= = = = = = = = = = = = = = = = = = = = = =
V u l n e r a b i l i t y d e t a i l s :
= = = = = = = = = = = = = = = = = = = = = =
T h e L i n u x K e r n e l c o n t a i n s a n i n f o r m a t i o n d i s c l o s u r e
v u l n e r a b i l i t y w h i l e
p a r s i n g t h e I O C T L S C T P _ H M A C _ I D E N T . E x p l o i t a t i o n o f t h i s
v u l n e r a b i l i t y c a n
a l l o w a l o c a l u n p r i v i l e g e d a t t a c k e r t o g a i n a c c e s s t o
s e n s i t i v e d a t a .
A d d i t i o n a l l y , t h e r e a r e v a r i o u s N U L L p o i n t e r d e r e f e r e n c e s
i n t h e S C T P - A U T H
A P I . A l l o f t h e S C T P - A U T H s o c k e t o p t i o n s c o u l d c a u s e a
k e r n e l p a n i c i f t h e
e x t e n s i o n i s d i s a b l e d a n d t h e A P I i s e n v o k e d . E x p l o i t a t i o n
o f t h e s e
v u l n e r a b i l i t i e s c a n a l l o w a n u n p r i v i l e g e d a t t a c k e r t o c r a s h
t h e s y s t e m
( D e n i a l o f S e r v i c e ) .
= = = = = = = = = = = = = = = = = = = = = =
T e c h n i c a l d e s c r i p t i o n :
= = = = = = = = = = = = = = = = = = = = = =
F r o m s o u r c e c o d e f i l e : n e t / s c t p / s o c k e t . c
[ . . . ]
S C T P _ S T A T I C i n t s c t p _ g e t s o c k o p t ( s t r u c t s o c k * s k , i n t l e v e l ,
i n t o p t n a m e ,
c h a r _ _ u s e r * o p t v a l , i n t _ _ u s e r * o p t l e n )
{
i n t r e t v a l = 0 ;
i n t l e n ;
[ . . . ]
i f ( g e t _ u s e r ( l e n , o p t l e n ) ) < - - [ 1 ]
r e t u r n - E F A U L T ;
[ . . . ]
c a s e S C T P _ H M A C _ I D E N T :
r e t v a l = s c t p _ g e t s o c k o p t _ h m a c _ i d e n t ( s k , l e n ,
o p t v a l , o p t l e n ) ; < - - [ 2 ]
b r e a k ;
[ . . . ]
[ 1 ] T h e u s e r c o n t r o l l e d v a l u e o f " o p t l e n " i s c o p i e d i n t o
" l e n "
[ 2 ] " l e n " i s u s e d a s a p a r a m e t e r f o r t h e f u n c t i o n
" s c t p _ g e t s o c k o p t _ h m a c _ i d e n t ( ) "
{ . . . ]
s t a t i c i n t s c t p _ g e t s o c k o p t _ h m a c _ i d e n t ( s t r u c t s o c k * s k , i n t
l e n ,
c h a r _ _ u s e r * o p t v a l , i n t _ _ u s e r
* o p t l e n )
{
s t r u c t s c t p _ h m a c _ a l g o _ p a r a m * h m a c s ;
_ _ u 1 6 p a r a m _ l e n ;
h m a c s = s c t p _ s k ( s k ) - > e p - > a u t h _ h m a c s _ l i s t ; < - - [ 3 ]
p a r a m _ l e n = n t o h s ( h m a c s - > p a r a m _ h d r . l e n g t h ) ; < - - [ 4 ]
i f ( l e n < p a r a m _ l e n ) < - - [ 5 ]
r e t u r n - E I N V A L ;
i f ( p u t _ u s e r ( l e n , o p t l e n ) )
r e t u r n - E F A U L T ;
i f ( c o p y _ t o _ u s e r ( o p t v a l , h m a c s - > h m a c _ i d s , l e n ) ) < - -
[ 6 ]
r e t u r n - E F A U L T ;
r e t u r n 0 ;
}
[ . . . ]
I f S C T P a u t h e n t i c a t i o n i s d i s a b l e d
( n e t . s c t p . a u t h _ e n a b l e = 0 ) :
[ 3 ] " h m a c s " g e t s N U L L
[ 4 ] " h m a c s - > p a r a m _ h d r . l e n g t h " l e a d s t o a N U L L p o i n t e r
d e r e f e r e n c e
T h a t ' s o n e e x a m p l e o f t h e m e n t i o n e d N U L L p o i n t e r
d e r e f e r e n c e s i n t h e
S C T P - A U T H A P I . F o r m o r e e x a m p l e s s e e [ 1 ] .
I f S C T P a u t h e n t i c a t i o n i s e n a b l e d ( n e t . s c t p . a u t h _ e n a b l e = 1 ) :
[ 3 ] " h m a c s " g e t s a v a l i d v a l u e
[ 4 ] " p a r a m _ l e n " g e t s a v a l i d v a l u e
[ 5 ] T h e l e n g t h c h e c k c a n b e e a s i l y p a s s e d a s " l e n " i s u s e r
c o n t r o l l e d
[ 6 ] " l e n " i s a u s e r c o n t r o l l e d v a l u e , t h e r e f o r e i t i s
p o s s i b l e t o c o n t r o l
t h e n u m b e r o f b y t e s t h a t g e t c o p i e d b a c k t o t h e u s e r
A s " l e n " i s n ' t v a l i d a t e d a t a l l a n u n p r i v i l e g e d u s e r c a n
r e a d a r b i t r a r y
d a t a f r o m m e m o r y .
= = = = = = = = =
S o l u t i o n :
= = = = = = = = =
T h e L i n u x K e r n e l m a i n t a i n e r s h a v e a d d r e s s e d t h e s e
v u l n e r a b i l i t i e s w i t h i n
v e r s i o n 2 . 6 . 2 6 . 4 . M o r e i n f o r m a t i o n c a n b e f o u n d f r o m t h e
U R L s s h o w n b e l o w .
h t t p : / / w w w . k e r n e l . o r g / p u b / l i n u x / k e r n e l / v 2 . 6 / C h a n g e L o g - 2 . 6 . 2 6 . 4
h t t p : / / g i t . k e r n e l . o r g / ? p = l i n u x / k e r n e l / g i t / s t a b l e / l i n u x -
2 . 6 . 2 6 . y . g i t ; a = c o m m i t ; h = b e 9 4 6 7 b d 7 5 b 5 2 2 a 3 d b 0 3 6 9 c 1 2 d b 7 3 9 f 7 9 7 c f e c 6 a
= = = = = = = =
H i s t o r y :
= = = = = = = =
2 0 0 8 / 0 8 / 2 0 - I n i t i a l n o t i f i c a t i o n o f k e r n e l m a i n t a i n e r s
2 0 0 8 / 0 8 / 2 0 - I n i t i a l r e s p o n s e f r o m k e r n e l m a i n t a i n e r s
2 0 0 8 / 0 9 / 0 8 - F i x p r o v i d e d
2 0 0 8 / 0 9 / 0 9 - P u b l i c d i s c l o s u r e
= = = = = = = =
C r e d i t s :
= = = = = = = =
V u l n e r a b i l i t i e s f o u n d a n d a d v i s o r y w r i t t e n b y T o b i a s
K l e i n .
= = = = = = = = = = =
R e f e r e n c e s :
= = = = = = = = = = =
[ 1 ]
h t t p : / / g i t . k e r n e l . o r g / ? p = l i n u x / k e r n e l / g i t / s t a b l e / l i n u x - 2 . 6 . 2 6 . y . g i t
; a = c o m m i t ; h = b e 9 4 6 7 b d 7 5 b 5 2 2 a 3 d b 0 3 6 9 c 1 2 d b 7 3 9 f 7 9 7 c f e c 6 a
[ 2 ]
h t t p : / / w w w . k e r n e l . o r g / p u b / l i n u x / k e r n e l / v 2 . 6 / C h a n g e L o g - 2 . 6 . 2 6 . 4
[ 3 ] h t t p : / / w w w . t r a p k i t . d e / a d v i s o r i e s / T K A D V 2 0 0 8 - 0 0 7 . t x t
= = = = = = = =
C h a n g e s :
= = = = = = = =
R e v i s i o n 0 . 1 - I n i t i a l d r a f t r e l e a s e t o t h e v e n d o r
R e v i s i o n 1 . 0 - P u b l i c r e l e a s e
R e v i s i o n 1 . 1 - A d j u s t e d p a t c h d e v e l o p m e n t t i m e ( t h a n k s t o
E u g e n e T e o
f o r p o i n t i n g t h i s o u t ) a n d a d d e d C V E - I D .
= = = = = = = = = = =
D i s c l a i m e r :
= = = = = = = = = = =
T h e i n f o r m a t i o n w i t h i n t h i s a d v i s o r y m a y c h a n g e w i t h o u t
n o t i c e . U s e
o f t h i s i n f o r m a t i o n c o n s t i t u t e s a c c e p t a n c e f o r u s e i n a n A S
I S
c o n d i t i o n . T h e r e a r e n o w a r r a n t i e s , i m p l i e d o r e x p r e s s ,
w i t h r e g a r d
t o t h i s i n f o r m a t i o n . I n n o e v e n t s h a l l t h e a u t h o r b e l i a b l e
f o r a n y
d i r e c t o r i n d i r e c t d a m a g e s w h a t s o e v e r a r i s i n g o u t o f o r i n
c o n n e c t i o n
w i t h t h e u s e o r s p r e a d o f t h i s i n f o r m a t i o n . A n y u s e o f t h i s
i n f o r m a t i o n i s a t t h e u s e r ' s o w n r i s k .
= = = = = = = = = = = = = = = = = =
P G P S i g n a t u r e K e y :
= = = = = = = = = = = = = = = = = =
h t t p : / / w w w . t r a p k i t . d e / a d v i s o r i e s / t k - a d v i s o r i e s - s i g n a t u r e - k e y . a s c
C o p y r i g h t 2 0 0 8 T o b i a s K l e i n . A l l r i g h t s r e s e r v e d .
- - - - - B E G I N P G P S I G N A T U R E - - - - -
w j 8 D B Q F I y D X G k X x g c A I b h E E R A k Q N A J 9 J F c S y f J g z x + a L O 0 J x f n w M 3 K T + b w C f S z Z t
/ g D L z u X w I P U R Q i y n m Q b J W 6 A =
= d O x n
- - - - - E N D P G P S I G N A T U R E - - - - -
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- [TKADV2008-007] Linux Kernel SCTP-AUTH API Information Disclosure Vulnerability and NULL Pointer Dereferences Tobias Klein (Sep 11)