This service will be undergoing maintenance at 00:00 UTC, 2016-08-01. It is expected to last about 1 hours
Bug 644156 - (CVE-2010-3848, CVE-2010-3849, CVE-2010-3850) CVE-2010-3848 CVE-2010-3849 CVE-2010-3850 kernel: multiple vulnerabilities in Linux AF_ECONET
CVE-2010-3848 CVE-2010-3849 CVE-2010-3850 kernel: multiple vulnerabilities in...
Status: CLOSED NOTABUG
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
low Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
: Security
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-10-18 23:19 EDT by Eugene Teo (Security Response)
Modified: 2016-06-10 18:25 EDT (History)
3 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-06-10 18:25:26 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:


Attachments (Terms of Use)

  None (edit)
Description Eugene Teo (Security Response) 2010-10-18 23:19:52 EDT
Description of problem:
Reported by Nelson Elhage.

CVE-2010-3848 AF_ECONET kernel stack overflow
CVE-2010-3849 AF_ECONET saddr->cookie NULL dereferences
CVE-2010-3850 AF_ECONET SIOCSIFADDR ioctl does not check privileges

The two main vulnerabilities lie in the econet_sendmsg() function. If CONFIG_ECONET_AUNUDP, the function declares a variable-length array of iovec's
on the stack:

static int econet_sendmsg(struct kiocb *iocb, struct socket *sock,
			  struct msghdr *msg, size_t len)
{
        ...
#ifdef CONFIG_ECONET_AUNUDP
	...
	struct iovec iov[msg->msg_iovlen+1];
	...
#endif

"msg->msg_iovlen" is a user-controlled value <= 1024; 1024 'struct iovec's is
enough to overflow the kernel stack and clobber the 'thread_info' struct on
either 32- or 64-bit systems with or without CONFIG_4KSTACKS.

The code populates 'iov' with user-controlled values, so this is almost
certainly exploitable for privesc.

The second bug is conveniently labeled as such for anyone who cares to look:

		/* BUG: saddr may be NULL */
		eb->cookie = saddr->cookie;

In fact, 'saddr' comes from userspace and may be NULL (if non-NULL, it will have
been copied to kernelspace), leading to a NULL-pointer dereference. This
saddr->cookie dereference appears twice, once in the "hardware" case and once in
the "UDP emulation" case. This is easily exploitable for an oops, but probably
not anything more.

The final issue is in the ec_dev_ioctl function. The SIOCSIFADDR ioctl does not
check privileges, allowing an unprivileged user to assign econet addresses to
arbitrary interfaces. It is possible this is intentional, but AFAIK it would be
unusual for SIOCSIFADDR to be unprivileged, so this may be an accident.

Note that it is necessary to use this property in order to make the first two
bugs exploitable, since econet_sendmsg will return almost immediately if no
econet addresses are configured.

Reference:
http://seclists.org/oss-sec/2010/q4/236
Comment 1 Eugene Teo (Security Response) 2010-10-18 23:20:49 EDT
Statement:

Not vulnerable. This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 3, 4, 5, 6 or Red Hat Enterprise MRG. Red Hat does not provide support for the Acorn Econet network protocol.

Note You need to log in before you can comment on or make changes to this bug.