Bug 1190546 (CVE-2014-9644)

Summary:	CVE-2014-9644 Linux kernel: crypto api unprivileged arbitrary module load via request_module()
Product:	[Other] Security Response	Reporter:	Wade Mealing <wmealing>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	low	Docs Contact:
Priority:	low
Version:	unspecified	CC:	aquini, ccoleman, dhoward, dmcphers, fhrbata, gansalmon, itamar, jforbes, jialiu, joelsmith, jokerman, jonathan, jrusnack, jwboyer, kernel-maint, kernel-mgr, lmeyer, madhu.chinakonda, mchehab, mmccomas, nmurray, plougher, pmatouse, rvrbovsk, slawomir, vgoyal
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:	A flaw was found in the way the Linux kernel's Crypto subsystem handled automatic loading of kernel modules. A local user could use this flaw to load any installed kernel module, and thus increase the attack surface of the running kernel.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2019-06-08 02:38:42 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1190547, 1190631, 1190927, 1199156, 1199157, 1199158
Bug Blocks:	1185470

Description Wade Mealing 2015-02-09 03:53:44 UTC

Linux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API that allows any local user to load any installed kernel module on systems where CONFIG_CRYPTO_USER_API=y by abusing the request_module() call.

In the introduction of Crypto User API in the linux kernel in version 2.6.38 introduced a defect which granted userspace applications to load kernel modules on the system, by abusing the request_module() kernel call.  This patch also fixes the

The kernel accomplished loading algorithms by searching for the matching kernel module name provided when a user attempts to use a socket via the AF_ALG socket type.  Initially there were no checks involved in validating the name of the module, users could provide string and the kernel would attempt to load a module by that name in the default search path for the specific version of the kernel.

This CVE fixes additional attack vector which by abusing the template module loading format.  It solves the attack vector in which target_module(cipher) would evade the existing protection mechanism introduced when fixing in CVE-2013-7421.


External reference:
https://lkml.org/lkml/2013/3/4/70
https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu
http://seclists.org/oss-sec/2015/q1/229

Fixed with these 3 commits:
https://git.kernel.org/linus/5d26a105b5a7
https://git.kernel.org/linus/4943ba16bbc2
https://git.kernel.org/linus/3e14dcf7cb80

Comment 5 Wade Mealing 2015-02-10 02:33:12 UTC

Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1190927]

Comment 6 Wade Mealing 2015-02-10 03:05:16 UTC

Statement:

This issue did not affect the versions of the kernel as shipped
with Red Hat Enterprise Linux 4, 5, and 6.

This issue affects the versions of the Linux as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Low  security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 9 errata-xmlrpc 2015-11-19 13:05:14 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2411 https://rhn.redhat.com/errata/RHSA-2015-2411.html

Comment 10 errata-xmlrpc 2015-11-19 21:28:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2152 https://rhn.redhat.com/errata/RHSA-2015-2152.html

Comment 11 errata-xmlrpc 2015-11-19 23:24:37 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2152 https://rhn.redhat.com/errata/RHSA-2015-2152.html