Bug 1185469 (CVE-2013-7421) - CVE-2013-7421 Linux kernel: crypto api unprivileged arbitrary module load via request_module()
Summary: CVE-2013-7421 Linux kernel: crypto api unprivileged arbitrary module load via...
Status: NEW
Alias: CVE-2013-7421
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,public=20130304,reported=2...
Keywords: Security
Depends On: 1190539 1190547 1190630 1190631 1190934 1199152 1199153 1199154 1199156 1199157 1199158
Blocks: 1185470
TreeView+ depends on / blocked
 
Reported: 2015-01-23 20:48 UTC by Kurt Seifried
Modified: 2019-02-08 14:56 UTC (History)
36 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
A flaw was found in the way the Linux kernel's Crypto subsystem handled automatic loading of kernel modules. A local user could use this flaw to load any installed kernel module, and thus increase the attack surface of the running kernel.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2015:2152 normal SHIPPED_LIVE Important: kernel security, bug fix, and enhancement update 2015-11-20 00:56:02 UTC
Red Hat Product Errata RHSA-2015:2411 normal SHIPPED_LIVE Important: kernel-rt security, bug fix, and enhancement update 2015-11-19 11:24:06 UTC

Description Kurt Seifried 2015-01-23 20:48:23 UTC
Mathias Krause reports:

Linux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API
that allows any local user to load any installed kernel module on systems
where CONFIG_CRYPTO_USER_API=y by abusing the request_module() call.

In the introduction of Crypto User API in the linux kernel in version 2.6.38 introduced a defect which granted userspace applications to load kernel modules on the system, by abusing the request_module() kernel call.


The intention was to allow applications to leverage in-kernel cryptographic functionality and load the requested module on demand.

The kernel accomplished loading algorithms by searching for the matching
kernel module name provided when a user attempts to use a socket via the
AF_ALG socket type.  Initially there were no checks involved in validating
the name of the module, users could provide string and the kernel would
attempt to load a module by that name in the default search path for the
specific version of the kernel.

The proposed fix for CVE-2013-7421 solved the issue for the simple use case, however there was an additional attack vector which by changing the string formatting any module can still be loaded.

External reference:
https://lkml.org/lkml/2013/3/4/70
https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu
http://seclists.org/oss-sec/2015/q1/229


Fixed with these 3 commits:
https://git.kernel.org/linus/5d26a105b5a7
https://git.kernel.org/linus/4943ba16bbc2
https://git.kernel.org/linus/3e14dcf7cb80

I have only done light testing and they seem to solve it for me.

Comment 1 Wade Mealing 2015-02-09 02:08:14 UTC
Edited comment #0 to include additional information.

Comment 7 Wade Mealing 2015-02-10 02:58:12 UTC
Statement:

This issue did not affect the versions of the kernel as shipped
with Red Hat Enterprise Linux 4, 5, and 6.

This issue affects the versions of the Linux as shipped with Red Hat Enterprise Linux 7. Red Hat Product Security has rated this issue as having Low  security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Comment 8 Wade Mealing 2015-02-10 03:06:18 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1190934]

Comment 11 errata-xmlrpc 2015-11-19 13:04:41 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2411 https://rhn.redhat.com/errata/RHSA-2015-2411.html

Comment 12 errata-xmlrpc 2015-11-19 21:18:05 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2152 https://rhn.redhat.com/errata/RHSA-2015-2152.html

Comment 13 errata-xmlrpc 2015-11-19 23:24:03 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2015:2152 https://rhn.redhat.com/errata/RHSA-2015-2152.html


Note You need to log in before you can comment on or make changes to this bug.