[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <AANLkTik1o+i+jo80NZXzDcRxWsA7bgcJTYP3hbMfw5W9@mail.gmail.com>
Date: Thu, 2 Dec 2010 10:31:55 -0500
From: Dan Rosenberg <dan.j.rosenberg@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: failure to revert address limit override in OOPS
error path
Nelson Elhage reported an issue in the Linux kernel. When the kernel
performs an address limit override via set_fs(KERNEL_DS) and
subsequently faults or BUGs before restoring USER_DS, the error path
includes calls to put_user() to a user-controlled address. Calls to
put_user() include access_ok() checks on the provided address to
ensure it lies in userspace. However, because of the address limit
override, these checks will always pass in this case, allowing the
process owner to turn an OOPS into a write to an arbitrary kernel
address, which can easily lead to privilege escalation.
This problem requires an additional vulnerability to exploit, but as
Nelson points out, it's not too uncommon for such issues to exist.
CVE-2010-3849 (NULL pointer dereference in Econet) is a recent example
that can be triggered under KERNEL_DS and used to escalate privileges
via this bug.
Reference:
http://marc.info/?l=linux-kernel&m=129117048916957&w=2
-Dan
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
