Bug 229884 - CVE-2007-0005 Buffer Overflow in Omnikey CardMan 4040 cmx driver
Summary: CVE-2007-0005 Buffer Overflow in Omnikey CardMan 4040 cmx driver
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel
Version: 5.0
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
: ---
Assignee: Don Howard
QA Contact: Brian Brock
URL:
Whiteboard: impact=moderate,source=vendorsec,repo...
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2007-02-23 23:06 UTC by Linda Wang
Modified: 2007-11-30 22:07 UTC (History)
2 users (show)

Fixed In Version: RHSA-2007-0099
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2007-03-14 15:05:01 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2007:0099 0 normal SHIPPED_LIVE Important: kernel security and bug fix update 2007-03-14 15:04:45 UTC

Comment 7 Marcel Holtmann 2007-03-02 15:56:48 UTC
From Daniel Roethlisberger wrote

While using the Linux drivers for the CM4040 as a reference for writing a cmx
FreeBSD driver I found two buffer overflows in the Linux drivers, one in the
write() and one in the read() handler.  

When calling write() with a buffer larger than 512 bytes, the driver's write
buffer overflows, allowing to overwrite the EIP and execute arbitrary code with
kernel privileges.  

In read(), we have a similar problem, but coming from the device. A malicous or
buggy device sending more than 512 bytes can overflow of the driver's read
buffer, with the same effects as above.

The write() vulnerability can only be exploited by a user with direct or
indirect write access to the cmx device special file. Normally, this is limited
to root, so this is not an issue. However, it might be possible for unprivileged
users to cause large writes indirectly via userland daemons such as those
provided by pcsc-lite or openct. Since "normal" APDU payloads are smaller than
512 bytes, this may not be an issue, but I haven't looked into that.
Furthermore, a system can be set up to allow access to the device for a special
user or group, in order to increase security by running the userland drivers
without root privileges. In such a setup, users with access to the device can
elevate privileges or cause DoS.

The problem code in cm4040_cs.c:cm4040_write() is on line 358 (current version
in Linus' git tree), when calling copy_from_user() with user supplied
bytes_to_write, which can be larger than 512 bytes. Because it does not seem to
make sense to write partial messages to this card reader, I think it is best to
return an appropriate error on write()'s larger than the write buffer. This is
what I do in the FreeBSD driver.

The problem code in cm4040_cs.c:cm4040_read() is around line 271 where
bytes_to_read is read from the card reader, and subsequently, min(count,
bytes_to_read + 5) bytes are read from the reader. min(count, bytes_to_read + 5)
can however be larger than the read buffer, which would cause an overflow.


Comment 9 Marcel Holtmann 2007-03-06 17:43:07 UTC
The embargo ended on 6th of March.

Comment 12 Red Hat Bugzilla 2007-03-14 15:05:01 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0099.html



Note You need to log in before you can comment on or make changes to this bug.