Bug 1283374 - CVE-2016-2782 Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid USB device descriptors (visor driver) [local-DoS]
CVE-2016-2782 Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on ...
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: kernel (Show other bugs)
Unspecified Unspecified
unspecified Severity high
: rc
: 7.3
Assigned To: Don Zickus
Mike Gahagan
: Security, SecurityTracking
Depends On:
Blocks: CVE-2016-2782
  Show dependency treegraph
Reported: 2015-11-18 15:24 EST by Ralf Spenneberg
Modified: 2016-11-08 11:28 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Release Note
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2016-03-11 08:53:28 EST
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
vUSBf Payload (145 bytes, text/plain)
2015-11-18 15:27 EST, Ralf Spenneberg
no flags Details
Stacktrace (5.10 KB, text/plain)
2015-11-18 15:30 EST, Ralf Spenneberg
no flags Details
Arduino firmware demonstrating the bug (16.68 KB, text/plain)
2015-11-18 15:34 EST, Ralf Spenneberg
no flags Details

  None (edit)
Description Ralf Spenneberg 2015-11-18 15:24:01 EST
Description of problem:
Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid 
USB device descriptors (visor driver) [local-DoS]

Version-Release number of selected component (if applicable):
Kernel-Version: 3.10.0-229.20.1.el7.x86_64 

How reproducible:

OpenSource Security Ralf Spenneberg
Am Bahnhof 3-5
48565 Steinfurt

Date: November 12th, 2015
Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg
CVE: not yet assigned
CVSS: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C) 
Title: Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid 
USB device descriptors (visor driver) [local-DoS]
Severity: Critical. The Kernel panics. A reboot is required.
Ease of Exploitation: Trivial
Vulnerability type: Wrong input validation
Products: RHEL 7.1 including all updates
Kernel-Version: 3.10.0-229.20.1.el7.x86_64 
(for debugging-purposes we used the CentOS Kernel kernel-debuginfo-3.10.0-229.14.1.el7)

The Kernel 3.10.0-229.20.1.el7.x86_64 crashes when presented a buggy USB 
device which requires the visor driver.
Detailed product description
We confirmed the bug on the following system:
RHEL 7.1
Kernel = 3.10.0-229.20.1.el7.x86_64
Further products or kernel versions have not been tested.
How reproducible: Always
Actual results: Kernel crashes 

The bug was found using the USB-fuzzing framework vUSBf from Sergej Schumilo 
(github.com/schumilo) using the following device descriptor:

 ######### PAYLOAD 1 #########
[*] Device-Descriptor
  bLength:		0x12
  bDescriptorType:	0x1
  bcdUSB:		0x200
  bDeviceClass:		0x3
  bDeviceSubClass:	0x0
  bDeviceProtocol:	0x0
  bMaxPacketSize:	0x40
  idVendor:		0x82d
  idProduct:		0x200
  bcdDevice:		0x100
  iManufacturer:	0x1
  iProduct:		0x2
  iSerialNumbers:	0x3
  bNumConfigurations:	0x1

The treo_attach function does not use the num_ports (struct usb_serial) value for any kind of sanity checks during the initialization process. Due to an incomplete sanity check, the driver could try to dereference a null-pointer if a malformed device-descriptor is presented (zero-value for bNumEndpoints or no required endpoint-descriptors is provided).
This results in a crash of the system. 

$ nm visor.ko.debug | grep treo_attach
00000000000005f0 t treo_attach
$ addr2line -e visor.ko.debug 0x651

**** CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c)
554	#define COPY_PORT(dest, src)						\
555	do { \
556		int i;							\
557									\
558		for (i = 0; i < ARRAY_SIZE(src->read_urbs); ++i) {	\
559			dest->read_urbs[i] = src->read_urbs[i];		\ /* Possible Nullpointer-Dereference */
560			dest->read_urbs[i]->context = dest;		\
561			dest->bulk_in_buffers[i] = src->bulk_in_buffers[i]; \
562		}							\
563		dest->read_urb = src->read_urb;				\
564		dest->bulk_in_endpointAddress = src->bulk_in_endpointAddress;\
565		dest->bulk_in_buffer = src->bulk_in_buffer;		\
566		dest->bulk_in_size = src->bulk_in_size;			\
567		dest->interrupt_in_urb = src->interrupt_in_urb;		\
568		dest->interrupt_in_urb->context = dest;			\
569		dest->interrupt_in_endpointAddress = \
570					src->interrupt_in_endpointAddress;\
571		dest->interrupt_in_buffer = src->interrupt_in_buffer;	\
572	} while (0);
574	swap_port = kmalloc(sizeof(*swap_port), GFP_KERNEL);
575	if (!swap_port)
576		return -ENOMEM;
577	COPY_PORT(swap_port, serial->port[0]);        /* no sanity-check! */
578	COPY_PORT(serial->port[0], serial->port[1]);  /* no sanity-check! */
579	COPY_PORT(serial->port[1], swap_port);        /* no sanity-check! */

	[*] Configuration-Descriptor
	  bLength:		0x9
	  bDescriptorType:	0x2
	  wTotalLength:		0x27
	  bNumInterfaces:	0x1
	  bConfigurationValue:	0x1
	  iConfiguration:	0x0
	  bmAttributes:		0x0
	  bMaxPower:		0x31
		[*] Interface-Descriptor
		  bLength:		0x9
		  bDescriptorType:	0x4
		  bInterfaceNumber:	0x0
		  bAlternateSetting:	0x0
		  bNumEndpoints:	0x3
		  bInterfaceClass:	0x0
		  bInterfaceSubClass:	0x0
		  bInterfaceProtocol:	0x0
			[*] Endpoint-Descriptor
			  bLength:		0x7
			  bDescriptorType:	0x5
			  bEndpointAddress:	0x81 
			  bmAttribut:		0x3  
			  wMaxPacketSize:	0x404
			  bInterval:		0xc
			[*] Endpoint-Descriptor
			  bLength:		0x7
			  bDescriptorType:	0x5
			  bEndpointAddress:	0x1  
			  bmAttribut:		0x2   
			  wMaxPacketSize:	0x4
			  bInterval:		0xc
			[*] Endpoint-Descriptor
			  bLength:		0x7
			  bDescriptorType:	0x5
			  bEndpointAddress:	0x82 
			  bmAttribut:		0x1   
			  wMaxPacketSize:	0x4
			  bInterval:		0xc

Proof of Concept:
1) The bug can be reproduced using USB-fuzzing framework vUSBf from Sergej Schumilo (github.com/schumilo). 
The attached vUSBf-obj file contains the payload. Please let us know if you would like to use the Facedancer board. 
In such case, we could also provide a patched version of vUSBf which allows to reproduce vUSBf-Payloads using the Facedancer board.
2) For a proof of concept we are providing also an Arduino firmware file. Just flash it 
on Arduino Leonardo and plug it into any RHEL machine. The Arduino will 
emulate the defective USB device.

   avrdude -v -p ATMEGA32u4 -c avr109 -P /dev/ttyACM0 -b 57600 -U flash:w:binary.hex

The file binary.hex has been attached to this bug report.
To prevent automated sending of payloads, use a jumper to connect port D3 and 

Severity and Ease of Exploitation
The security weakness can be easily exploited. Using our Arduino firmware only 
physical access to the system is required. 

Additional info:
Stacktrace, vUSBf-Payload, Arduino-Firmware attached.

Please assign a CVE for this issue since this is a local DoS of the targeted system. 
CVSS 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Comment 1 Ralf Spenneberg 2015-11-18 15:27 EST
Created attachment 1096281 [details]
vUSBf Payload
Comment 2 Ralf Spenneberg 2015-11-18 15:30 EST
Created attachment 1096282 [details]
Comment 3 Ralf Spenneberg 2015-11-18 15:34 EST
Created attachment 1096284 [details]
Arduino firmware demonstrating the bug
Comment 4 Vladis Dronov 2016-02-28 11:14:45 EST
this was fixed by Johan Hovold <johan@kernel.org> in the upstream commit cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 by adding endpoints number check required:

[ http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cac9b50b0d75a1d50d6c056ff65c005f3224c8e0 ]
+	if (serial->num_bulk_in < 2 || serial->num_interrupt_in < 2) {
+		dev_err(&serial->interface->dev, "missing endpoints\n");
+		return -ENODEV;
+	}
Comment 5 Vladis Dronov 2016-03-11 08:53:28 EST
Thank you for reporting this flaw.

The Product Security has rated this flaw as having low security impact (bz#1312670), so the patch currently is not planned to be added to the RHEL source trees. The upstream and Fedora patches are completed (at least, I hope so), so the patch may get to the RHEL trees at the next USB subsystem code rebase.
Comment 6 Adam Mariš 2016-03-14 06:40:47 EDT
Public via:


Note You need to log in before you can comment on or make changes to this bug.