oss-security - CVE request: kernel: two bluetooth and one ebtables infoleaks/DoSes

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20110228194836.GA9440@albatros>
Date: Mon, 28 Feb 2011 22:48:36 +0300
From: Vasiliy Kulikov <segoon@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: CVE request: kernel: two bluetooth and one ebtables infoleaks/DoSes

Hi,

"struct sco_conninfo has one padding byte in the end.  Local variable
cinfo of type sco_conninfo is copied to userspace with this
uninizialized one byte, leading to old stack contents leak."

https://lkml.org/lkml/2011/2/14/49

"Struct ca is copied from userspace.  It is not checked whether the
"device" field is NULL terminated.  This potentially leads to BUG()
inside of alloc_netdev_mqs() and/or information leak by creating a
device with a name made of contents of kernel stack."

https://lkml.org/lkml/2011/2/14/50

"Struct tmp is copied from userspace.  It is not checked whether the
"name" field is NULL terminated.  This may lead to buffer overflow and
passing contents of kernel stack as a module name to
try_then_request_module() and, consequently, to modprobe commandline.
It would be seen by all userspace processes."

https://lkml.org/lkml/2011/2/14/51

The vulnerable code was written before the "git epoch".  One needs
CAP_NET_ADMIN to exploit the 2nd and the 3rd.

JFI, the patch to prevent the panic inside of alloc_netdev() (to prevent
analogues of #2) was rejected by upstream:

https://lkml.org/lkml/2011/2/14/52

Thanks,

-- 
Vasiliy Kulikov
http://www.openwall.com - bringing security into open computing environments

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.