[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <FC72FC641B949240B947AC6F1F83FBAF33E35B3E@IMCMBX01.MITRE.ORG>
Date: Tue, 26 Nov 2013 00:57:23 +0000
From: "Christey, Steven M." <coley@...re.org>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: RE: CVE request: Kernel MSM - Memory leak in
drivers/base/genlock.c
Kurt said:
>> The Genlock driver does not properly initialize all members of a
>> structure before copying it to user space. This allows a local
>> attacker to obtain potentially sensitive information from kernel
>> stack memory via ioctl system calls.
>
>This should be classified as CWE-200 Information Disclosure, "memory
>leak" refers to memory being used and not released properly, resulting
>in out of memory conditions.
In CWE, we discourage the "memory leak" term because it has multiple meanings and interpretations: (1) that memory is allocated but never released, or (2) that sensitive portions of memory are accidentally disclosed to untrusted parties.
This request sounds like variant (2) of the varying uses of the "memory leak" term, although Kurt's interpretation seems to be that it's about variant (1), which further reinforces my personal desire to see that term go away forever.
Anyway... Note that, as this issue is described, "information disclosure" actually results from a root cause in which certain locations are not properly initialized. Thus CWE-665: Improper Initialization (or its child CWE-457 Use of Uninitialized Variable) are probably more appropriate characterizations of the core issue; in this case, it happens to lead to memory disclosure, but in other cases, it might lead to privilege escalation or other consequences (depending on how the uninitialized data is used.)
Note that vulnerabilities can be combinations of 2 or more less-significant errors, which in CWE are called chains or composites:
http://cwe.mitre.org/data/reports/chains_and_composites.html
That is, just like there can be attack chains, there can be vulnerability chains.
As vulnerabilities become more and more complex (because the easy stuff is slowly getting eliminated), chains and composites are likely to pose more and more challenges for vulnerability classification in the future. The Linux kernel is one of those places.
For CVE assignment purposes, we generally try to classify based on the root cause, but there is a recognition that opinions may vary widely in this area.
- Steve
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
