Bug 1344721 (CVE-2016-1583) - CVE-2016-1583 kernel: Stack overflow via ecryptfs and /proc/$pid/environ
Summary: CVE-2016-1583 kernel: Stack overflow via ecryptfs and /proc/$pid/environ
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2016-1583
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1344722 1347100 1347101 1347102 1347103 1347104 1351947 1351948 1351950 1351951 1478839
Blocks: 1344248
TreeView+ depends on / blocked
 
Reported: 2016-06-10 14:07 UTC by Adam Mariš
Modified: 2021-03-11 14:35 UTC (History)
33 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/environ. An unprivileged, local user could potentially use this flaw to escalate their privileges on the system.
Clone Of:
Environment:
Last Closed: 2019-07-12 13:04:13 UTC
Embargoed:

Attachments (Terms of Use)
Patch (1.08 KB, patch)
2016-06-10 14:11 UTC, Adam Mariš 		no flags Details | Diff
Show Obsolete (1) View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2124 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2016-10-28 13:28:10 UTC
Red Hat Product Errata RHSA-2016:2766 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2016-11-16 00:36:52 UTC
Red Hat Product Errata RHSA-2017:2760 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-09-19 12:23:35 UTC

Description Adam Mariš 2016-06-10 14:07:24 UTC 
The ecryptfs mechanism can be used to mmap files that normally wouldn't be mmapable, especially /proc/$pid/{mem,environ,cmdline} files. An attacker could chain e.g. /proc/$pid/environ mappings where process 1 has /proc/2/environ mapped into its environment area, process 2 has /proc/3/environ mapped into its environment area and so on, that can lead to kernel stack overflow.

This can be chained together into a stack overflow and an attacker can escalate their privileges.

Upstream:

 http://seclists.org/oss-sec/2016/q2/522

Upstream patches:

 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9

 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2f36db71009304b3f0b95afacd8eba1f9f046b87

 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=29d6455178a09e1dc340380c582b13356227e8df
Comment 1 Adam Mariš 2016-06-10 14:08:33 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1344722]
Comment 2 Adam Mariš 2016-06-10 14:11:33 UTC 
Created attachment 1166655 [details]
Patch
Comment 5 Adam Mariš 2016-06-13 08:54:23 UTC 
According to http://seclists.org/oss-sec/2016/q2/522 , if backporting patches into pre 4.6 kernel, one may need to cherry-pick 6a480a7842545ec520a91730209ec0bae41694c1

https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable/+/6a480a7842545ec520a91730209ec0bae41694c1
Comment 9 Wade Mealing 2016-06-16 05:02:13 UTC 
Statement:

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5 and 6 and may addressed in a future update.
Comment 12 Andrej Nemec 2016-06-22 11:20:58 UTC 
Upstream bug (including the reproducer):

https://bugs.chromium.org/p/project-zero/issues/detail?id=836
Comment 13 Fedora Update System 2016-06-30 21:23:38 UTC 
kernel-4.6.3-300.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.
Comment 18 Fedora Update System 2016-07-02 19:24:00 UTC 
kernel-4.5.7-202.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.
Comment 19 Fedora Update System 2016-07-19 07:19:10 UTC 
kernel-4.4.14-200.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.
Comment 20 cdc100 2016-09-30 01:46:27 UTC 
you cannot mount ecryptfs directories with kernel-4.4.14-200.fc22, the message "wrong medium type" appears when you change into the directory and try to list it. Accessing a file works if you know the path.
See also https://bbs.archlinux.org/viewtopic.php?id=214258
Comment 21 cdc100 2016-09-30 01:47:06 UTC 
For the sake of completion, https://www.spinics.net/lists/ecryptfs/msg00816.html
Comment 22 errata-xmlrpc 2016-10-28 09:28:37 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2016:2124 https://rhn.redhat.com/errata/RHSA-2016-2124.html
Comment 23 errata-xmlrpc 2016-11-15 19:39:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:2766 https://rhn.redhat.com/errata/RHSA-2016-2766.html
Comment 25 errata-xmlrpc 2017-09-19 08:24:27 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support

Via RHSA-2017:2760 https://access.redhat.com/errata/RHSA-2017:2760
Comment 26 Product Security DevOps Team 2019-07-12 13:04:13 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2016-1583
Note You need to log in before you can comment on or make changes to this bug.