[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20161230134600.vva3eii4zfzm3r3d@eldamar.local>
Date: Fri, 30 Dec 2016 14:46:00 +0100
From: Salvatore Bonaccorso <carnil@...ian.org>
To: oss-security@...ts.openwall.com
Cc: Ben Hutchings <benh@...ian.org>, Marcus Meissner <meissner@...e.de>
Subject: Re: Linux Kernel use-after-free in SCSI generic
device interface
Hi Marcus, hi List
On Fri, Dec 09, 2016 at 12:14:15AM +0100, Marcus Meissner wrote:
> Hi folks,
>
> This is CVE-2016-9576.
>
> This original post from Dmitry Vyukov <dvyukov @ google . com> has a kasan/syzkaller report:
> https://marc.info/?l=linux-scsi&m=148010092224801&w=2
>
> https://gist.githubusercontent.com/dvyukov/80cd94b4e4c288f16ee4c787d404118b/raw/10536069562444da51b758bb39655b514ff93b45/gistfile1.txt
>
> which in turn turned out to be a kernel memory read or
> potentially even a kernel memory write, in using the scatter gather
> write mode of the /dev/sg* scsi generic devices.
>
> The affected code is in Linux down to 2.6.something (problem might require splice() to be exploitable).
>
> Linus has committed a fix for this to mainline:
>
> commit a0ac402cfcdc904f9772e1762b3fda112dcc56a0
> Author: Linus Torvalds <torvalds@...ux-foundation.org>
> Date: Tue Dec 6 16:18:14 2016 -0800
>
> Don't feed anything but regular iovec's to blk_rq_map_user_iov
>
> In theory we could map other things, but there's a reason that function
> is called "user_iov". Using anything else (like splice can do) just
> confuses it.
>
> Reported-and-tested-by: Johannes Thumshirn <jthumshirn@...e.de>
> Cc: Al Viro <viro@...IV.linux.org.uk>
> Signed-off-by: Linus Torvalds <torvalds@...ux-foundation.org>
Just a heads up on CVE-2016-9576.
Ben Hutchings (Cc'ed) noticed that whilst the originally identified
commit does partly address the issue, the completed fix for the sg and
bsg driver appears to be 128394eff343fc6d2f32172f03e24829539c5835.
https://git.kernel.org/linus/128394eff343fc6d2f32172f03e24829539c5835
In Debian for the upcoming kernel updates for 3.16.x in Jessie and
3.2.x in Wheezy, thus the above was used to address CVE-2016-9576.
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=jessie&id=160c700612e57b2939fda763430e08dd089b2496
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=wheezy-security&id=d8cef48e69ba67583c1fc2ec8953538218054cfe
This might raise the question if we need two CVE assignments per the
two commits, or just keeping the one assigned CVE to identify the
issue?
Regards,
Salvatore
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
