Bug 229884 - CVE-2007-0005 Buffer Overflow in Omnikey CardMan 4040 cmx driver
CVE-2007-0005 Buffer Overflow in Omnikey CardMan 4040 cmx driver
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 5
Classification: Red Hat
Component: kernel (Show other bugs)
5.0
All Linux
medium Severity medium
: ---
: ---
Assigned To: Don Howard
Brian Brock
impact=moderate,source=vendorsec,repo...
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2007-02-23 18:06 EST by Linda Wang
Modified: 2007-11-30 17:07 EST (History)
2 users (show)

See Also:
Fixed In Version: RHSA-2007-0099
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2007-03-14 11:05:01 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Comment 7 Marcel Holtmann 2007-03-02 10:56:48 EST
From Daniel Roethlisberger wrote

While using the Linux drivers for the CM4040 as a reference for writing a cmx
FreeBSD driver I found two buffer overflows in the Linux drivers, one in the
write() and one in the read() handler.  

When calling write() with a buffer larger than 512 bytes, the driver's write
buffer overflows, allowing to overwrite the EIP and execute arbitrary code with
kernel privileges.  

In read(), we have a similar problem, but coming from the device. A malicous or
buggy device sending more than 512 bytes can overflow of the driver's read
buffer, with the same effects as above.

The write() vulnerability can only be exploited by a user with direct or
indirect write access to the cmx device special file. Normally, this is limited
to root, so this is not an issue. However, it might be possible for unprivileged
users to cause large writes indirectly via userland daemons such as those
provided by pcsc-lite or openct. Since "normal" APDU payloads are smaller than
512 bytes, this may not be an issue, but I haven't looked into that.
Furthermore, a system can be set up to allow access to the device for a special
user or group, in order to increase security by running the userland drivers
without root privileges. In such a setup, users with access to the device can
elevate privileges or cause DoS.

The problem code in cm4040_cs.c:cm4040_write() is on line 358 (current version
in Linus' git tree), when calling copy_from_user() with user supplied
bytes_to_write, which can be larger than 512 bytes. Because it does not seem to
make sense to write partial messages to this card reader, I think it is best to
return an appropriate error on write()'s larger than the write buffer. This is
what I do in the FreeBSD driver.

The problem code in cm4040_cs.c:cm4040_read() is around line 271 where
bytes_to_read is read from the card reader, and subsequently, min(count,
bytes_to_read + 5) bytes are read from the reader. min(count, bytes_to_read + 5)
can however be larger than the read buffer, which would cause an overflow.
Comment 9 Marcel Holtmann 2007-03-06 12:43:07 EST
The embargo ended on 6th of March.
Comment 12 Red Hat Bugzilla 2007-03-14 11:05:01 EDT
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0099.html

Note You need to log in before you can comment on or make changes to this bug.