oss-security - Advisory report - Multiple memory corruption and race condition in Goodix gt915 Android touchscreen driver (CVE-2013-4740 & CVE-2013-6122)

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAEmQOhDfUJAFyK3L0a2DS03s69ATvSJG_ZZrCdN+gRYZBrGH0w@mail.gmail.com>
Date: Fri, 8 Nov 2013 01:01:58 +0000
From: Jonathan Salwan <jonathan.salwan@...il.com>
To: oss-security@...ts.openwall.com
Subject: Advisory report - Multiple memory corruption and race condition in
 Goodix gt915 Android touchscreen driver (CVE-2013-4740 & CVE-2013-6122)

Description
========
Multiple issues have been identified in the Goodix gt915 touchscreen
driver for Android. The issues were found in the write handler of the
procfs entry created by the driver, which by default is readable and
writeable to users without any specific privileges.

CVE-2013-4740
----------------------
When processing data written to the procfs file, the Goodix gt915
touchscreen driver is using user space supplied content as length
values in subsequent memory manipulation operations without
bounds checking. This can lead to multiple memory corruption issues.
An application with access to the respective file can use this flaw
to, e.g., elevate privileges.

Access Vector: local
Security Risk: high
Vulnerability: CWE-20 (Improper Input Validation)

CVE-2013-6122
-----------------------
When processing arguments passed to the procfs write handler of
the Goodix gt915 touchscreen driver, user space data is copied to
a global variable and used without a mutual-exclusion mechanism.
The global structure used by the procfs write handler can be accessed
concurrently by more than one process. This would allow local attackers
to bypass the input validation checks (such as introduced by the fix for
CVE-2013-4740). An application with access to the respective file can use
this flaw to, e.g., alter the internal state of the handler, bypass security
checks, or create a denial-of-service condition.

Access Vector: local
Security Risk: medium
Vulnerability: CWE-362 (Concurrent Execution using Shared Resource
with Improper Synchronization)

Affected versions
All Android releases from CAF using a Linux kernel from the following heads:

jb_3*
msm-3.10
Patch
We advise customers to apply the following patches:
https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05

Acknowledgement
=============
Qualcomm Innovation Center, Inc. (QuIC) thanks Jonathan Salwan of the
Sysdream Security Lab for reporting the related issues and working with
QuIC to help improve Android device security.

https://www.codeaurora.org/projects/security-advisories/multiple-memory-corruption-issues-and-race-condition-goodix-gt915-touchscreen-driver-procfs-handler

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.