Bug 1344721 (CVE-2016-1583)
| Summary: | CVE-2016-1583 kernel: Stack overflow via ecryptfs and /proc/$pid/environ | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Adam Mariš <amaris> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | high | Docs Contact: | |||||
| Priority: | high | ||||||
| Version: | unspecified | CC: | apmukher, aquini, arm-mgr, bhu, carnil, cdc100, dhoward, fhrbata, gansalmon, iboverma, itamar, jforbes, jkacur, joelsmith, jonathan, jross, jwboyer, kernel-maint, kernel-mgr, kharnam, kstutsma, lgoncalv, madhu.chinakonda, matt, mchehab, mcressma, nmurray, plougher, rt-maint, rvrbovsk, slawomir, williams, wmealing | ||||
| Target Milestone: | --- | Keywords: | Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |||||
| Doc Text: |
It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/environ. An unprivileged, local user could potentially use this flaw to escalate their privileges on the system.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2019-07-12 13:04:13 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1344722, 1347100, 1347101, 1347102, 1347103, 1347104, 1351947, 1351948, 1351950, 1351951, 1478839 | ||||||
| Bug Blocks: | 1344248 | ||||||
| Attachments: |
|
||||||
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1344722] Created attachment 1166655 [details]
Patch
According to http://seclists.org/oss-sec/2016/q2/522 , if backporting patches into pre 4.6 kernel, one may need to cherry-pick 6a480a7842545ec520a91730209ec0bae41694c1 https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable/+/6a480a7842545ec520a91730209ec0bae41694c1 Statement: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5 and 6 and may addressed in a future update. Upstream bug (including the reproducer): https://bugs.chromium.org/p/project-zero/issues/detail?id=836 kernel-4.6.3-300.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report. kernel-4.5.7-202.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report. kernel-4.4.14-200.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report. you cannot mount ecryptfs directories with kernel-4.4.14-200.fc22, the message "wrong medium type" appears when you change into the directory and try to list it. Accessing a file works if you know the path. See also https://bbs.archlinux.org/viewtopic.php?id=214258 For the sake of completion, https://www.spinics.net/lists/ecryptfs/msg00816.html This issue has been addressed in the following products: Red Hat Enterprise Linux 5 Via RHSA-2016:2124 https://rhn.redhat.com/errata/RHSA-2016-2124.html This issue has been addressed in the following products: Red Hat Enterprise Linux 6 Via RHSA-2016:2766 https://rhn.redhat.com/errata/RHSA-2016-2766.html This issue has been addressed in the following products: Red Hat Enterprise Linux 6.7 Extended Update Support Via RHSA-2017:2760 https://access.redhat.com/errata/RHSA-2017:2760 This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2016-1583 |
The ecryptfs mechanism can be used to mmap files that normally wouldn't be mmapable, especially /proc/$pid/{mem,environ,cmdline} files. An attacker could chain e.g. /proc/$pid/environ mappings where process 1 has /proc/2/environ mapped into its environment area, process 2 has /proc/3/environ mapped into its environment area and so on, that can lead to kernel stack overflow. This can be chained together into a stack overflow and an attacker can escalate their privileges. Upstream: http://seclists.org/oss-sec/2016/q2/522 Upstream patches: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2f36db71009304b3f0b95afacd8eba1f9f046b87 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=29d6455178a09e1dc340380c582b13356227e8df