Bug 1344721 (CVE-2016-1583) - CVE-2016-1583 kernel: Stack overflow via ecryptfs and /proc/$pid/environ
Summary: CVE-2016-1583 kernel: Stack overflow via ecryptfs and /proc/$pid/environ
Status: ASSIGNED
Alias: CVE-2016-1583
Product: Security Response
Classification: Other
Component: vulnerability   
(Show other bugs)
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=important,public=20160610,repo...
Keywords: Security
Depends On: 1344722 1347100 1347101 1347102 1347103 1347104 1351947 1351948 1351950 1351951 1478839
Blocks: 1344248
TreeView+ depends on / blocked
 
Reported: 2016-06-10 14:07 UTC by Adam Mariš
Modified: 2019-02-08 14:56 UTC (History)
34 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
It was found that stacking a file system over procfs in the Linux kernel could lead to a kernel stack overflow due to deep nesting, as demonstrated by mounting ecryptfs over procfs and creating a recursion by mapping /proc/environ. An unprivileged, local user could potentially use this flaw to escalate their privileges on the system.
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
Patch (1.08 KB, patch)
2016-06-10 14:11 UTC, Adam Mariš
no flags Details | Diff


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2016:2124 normal SHIPPED_LIVE Important: kernel security and bug fix update 2016-10-28 13:28:10 UTC
Red Hat Product Errata RHSA-2016:2766 normal SHIPPED_LIVE Important: kernel security and bug fix update 2016-11-16 00:36:52 UTC
Red Hat Product Errata RHSA-2017:2760 normal SHIPPED_LIVE Important: kernel security and bug fix update 2017-09-19 12:23:35 UTC

Description Adam Mariš 2016-06-10 14:07:24 UTC
The ecryptfs mechanism can be used to mmap files that normally wouldn't be mmapable, especially /proc/$pid/{mem,environ,cmdline} files. An attacker could chain e.g. /proc/$pid/environ mappings where process 1 has /proc/2/environ mapped into its environment area, process 2 has /proc/3/environ mapped into its environment area and so on, that can lead to kernel stack overflow.

This can be chained together into a stack overflow and an attacker can escalate their privileges.

Upstream:

 http://seclists.org/oss-sec/2016/q2/522

Upstream patches:

 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e54ad7f1ee263ffa5a2de9c609d58dfa27b21cd9

 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2f36db71009304b3f0b95afacd8eba1f9f046b87

 https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=29d6455178a09e1dc340380c582b13356227e8df

Comment 1 Adam Mariš 2016-06-10 14:08:33 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1344722]

Comment 2 Adam Mariš 2016-06-10 14:11 UTC
Created attachment 1166655 [details]
Patch

Comment 5 Adam Mariš 2016-06-13 08:54:23 UTC
According to http://seclists.org/oss-sec/2016/q2/522 , if backporting patches into pre 4.6 kernel, one may need to cherry-pick 6a480a7842545ec520a91730209ec0bae41694c1

https://kernel.googlesource.com/pub/scm/linux/kernel/git/stable/linux-stable/+/6a480a7842545ec520a91730209ec0bae41694c1

Comment 9 Wade Mealing 2016-06-16 05:02:13 UTC
Statement:

This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5 and 6 and may addressed in a future update.

Comment 12 Andrej Nemec 2016-06-22 11:20:58 UTC
Upstream bug (including the reproducer):

https://bugs.chromium.org/p/project-zero/issues/detail?id=836

Comment 13 Fedora Update System 2016-06-30 21:23:38 UTC
kernel-4.6.3-300.fc24 has been pushed to the Fedora 24 stable repository. If problems still persist, please make note of it in this bug report.

Comment 18 Fedora Update System 2016-07-02 19:24:00 UTC
kernel-4.5.7-202.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, please make note of it in this bug report.

Comment 19 Fedora Update System 2016-07-19 07:19:10 UTC
kernel-4.4.14-200.fc22 has been pushed to the Fedora 22 stable repository. If problems still persist, please make note of it in this bug report.

Comment 20 cdc100 2016-09-30 01:46:27 UTC
you cannot mount ecryptfs directories with kernel-4.4.14-200.fc22, the message "wrong medium type" appears when you change into the directory and try to list it. Accessing a file works if you know the path.
See also https://bbs.archlinux.org/viewtopic.php?id=214258

Comment 21 cdc100 2016-09-30 01:47:06 UTC
For the sake of completion, https://www.spinics.net/lists/ecryptfs/msg00816.html

Comment 22 errata-xmlrpc 2016-10-28 09:28:37 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 5

Via RHSA-2016:2124 https://rhn.redhat.com/errata/RHSA-2016-2124.html

Comment 23 errata-xmlrpc 2016-11-15 19:39:22 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6

Via RHSA-2016:2766 https://rhn.redhat.com/errata/RHSA-2016-2766.html

Comment 25 errata-xmlrpc 2017-09-19 08:24:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 6.7 Extended Update Support

Via RHSA-2017:2760 https://access.redhat.com/errata/RHSA-2017:2760


Note You need to log in before you can comment on or make changes to this bug.