CVE-2014-0038: Linux Kernel Remote Memory Corruption Vulnerability

unSpawn · 01-31-2014, 10:09 PM

http://seclists.org/oss-sec/2014/q1/187:

Quote:

The impact is a sort of arbitrary kernel write-where-what primitive by unprivileged users where the to-be-written area must contain valid timespec data initially (the first 64 bit long field must be positive
and the second one must be < 1G).

The bug was introduced by commit http://git.kernel.org/linus/ee4fa23c4b (other uses of COMPAT_USE_64BIT_TIME seem fine) and should affect all kernels since 3.4 (and perhaps vendor kernels if they backported x32 support along with this code). Note that CONFIG_X86_X32_ABI gets enabled at build time and only if CONFIG_X86_X32 is enabled and ld can build x32
executables.

http://www.securityfocus.com/bid/65255/info:

Quote:

Linux Kernel 'compat_sys_recvmmsg()' Function Remote Memory Corruption Vulnerability

The Linux Kernel is prone to a remote memory-corruption vulnerability.

A remote attacker can exploit this issue to execute arbitrary code with kernel privileges, corrupt the kernel memory, obtain sensitive information or crash the kernel; resulting in a denial-of-service condition.

Linux kernel 3.4 and above are vulnerable.

http://cve.mitre.org/cgi-bin/cvename...=CVE-2014-0038

unSpawn · 02-20-2014, 01:05 AM

see http://www.kernel.org/pub/linux/kern...angeLog-3.13.2