Bug 770777 (CVE-2011-1493, CVE-2011-4913, CVE-2011-4914)

Summary: CVE-2011-1493 CVE-2011-4913 CVE-2011-4914 kernel: multiple issues in rose protocol
Product: [Other] Security Response Reporter: Eugene Teo (Security Response) <eteo>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: agordeev, anton, arozansk, bhu, davej, dhoward, fhrbata, gansalmon, itamar, jkacur, jonathan, jwboyer, kernel-maint, kernel-mgr, lgoncalv, lwang, madhu.chinakonda, plougher, rcvalle, rt-maint, sforsber, vgoyal, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2012-03-29 02:59:51 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 770778    
Bug Blocks: 770769    

Description Eugene Teo (Security Response) 2011-12-29 03:07:44 UTC 
"When parsing the FAC_NATIONAL_DIGIS facilities field, it's possible for a remote host to provide more digipeaters than expected, resulting in heap corruption.  Check against ROSE_MAX_DIGIS to prevent overflows, and abort facilities parsing on failure.

Additionally, when parsing the FAC_CCITT_DEST_NSAP and FAC_CCITT_SRC_NSAP facilities fields, a remote host can provide a length of less than 10, resulting in an underflow in a memcpy size, causing a kernel panic due to massive heap corruption.  A length of greater than 20 results in a stack overflow of the callsign array.  Abort facilities parsing on these invalid length values."

These issues may both result in code execution.  They may be triggered by a remote attacker if the victim has a listening ROSE socket, or by a local attacker (for privilege escalation) if a ROSE device exists (e.g. rose0).

Ben Hutchings followed up with a patch [2] that resolves a number of other ROSE issues related to lack of size field validation, some of which may also result in heap corruption.

[1] http://marc.info/?l=linux-netdev&m=130060344616926
[2] http://marc.info/?l=linux-netdev&m=130063972406389&w=2

Acknowledgements:

Red Hat would like to thank Dan Rosenberg for reporting this issue.
Comment 1 Eugene Teo (Security Response) 2011-12-29 03:11:20 UTC 
Created kernel tracking bugs for this issue

Affects: fedora-all [bug 770778]
Comment 2 Eugene Teo (Security Response) 2011-12-29 06:13:45 UTC 
Statement CVE-2011-1493:

Not vulnerable. This issue did not affect the versions of Linux kernel as
shipped with Red Hat Enterprise Linux 4, 5, 6, or Red Hat Enterprise MRG. Red
Hat does not provide support for the ROSE protocol.

Statement CVE-2011-4913:

Not vulnerable. This issue did not affect the versions of Linux kernel as
shipped with Red Hat Enterprise Linux 4, 5, 6, or Red Hat Enterprise MRG. Red
Hat does not provide support for the ROSE protocol.

Statement CVE-2011-4914:

Not vulnerable. This issue did not affect the versions of Linux kernel as
shipped with Red Hat Enterprise Linux 4, 5, 6, or Red Hat Enterprise MRG. Red
Hat does not provide support for the ROSE protocol.