Next Page >>
user space
inadvertently increasing their risk due to a bug that makes standard
Windows anti-exploitation mechanisms ineffective.
A vulnerability found in the memory management of the Virtual Machine
Monitor makes memory pages mapped above the 2GB available with read or
read/write access to user-space programs running in a Guest operating
system. By leveraging this vulnerability it is possible to bypass
security mechanisms of the operating system such as Data Execution
Prevention (DEP) [1], Safe Structured Error Handling (SafeSEH) [2] and
Address Space Layout Randomization (ASLR) [3] designed to prevent
exploitation of security bugs in applications running on Windows
* -------------
* This is the interesting one, and the reason I wrote this exploit. If a
* thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a NULL
* word will be written to a user-specified pointer when that thread exits.
* This write is done using put_user(), which ensures the provided destination
* resides in valid userspace by invoking access_ok(). However, Nelson
* discovered that when the kernel performs an address limit override via
* set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page fault,
* etc.), this override is not reverted before calling put_user() in the exit
* path, allowing a user to write a NULL word to an arbitrary kernel address.
* Note that this issue requires an additional vulnerability to trigger.
> * -------------
> * This is the interesting one, and the reason I wrote this exploit. If a
> * thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a NULL
> * word will be written to a user-specified pointer when that thread exits.
> * This write is done using put_user(), which ensures the provided destination
> * resides in valid userspace by invoking access_ok(). However, Nelson
> * discovered that when the kernel performs an address limit override via
> * set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page fault,
> * etc.), this override is not reverted before calling put_user() in the exit
> * path, allowing a user to write a NULL word to an arbitrary kernel address.
> * Note that this issue requires an additional vulnerability to trigger.
> * -------------
> * This is the interesting one, and the reason I wrote this exploit. If a
> * thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a NULL
> * word will be written to a user-specified pointer when that thread exits.
> * This write is done using put_user(), which ensures the provided destination
> * resides in valid userspace by invoking access_ok(). However, Nelson
> * discovered that when the kernel performs an address limit override via
> * set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page fault,
> * etc.), this override is not reverted before calling put_user() in the exit
> * path, allowing a user to write a NULL word to an arbitrary kernel address.
> * Note that this issue requires an additional vulnerability to trigger.
* trivially allows you to get root. However, I found another way to get root
* from CAP_SYS_ADMIN...the hard way.
*
* This exploit leverages a signedness error in the Phonet protocol. By
* specifying a negative protocol index, I can craft a series of fake
* structures in userspace and cause the incrementing of an arbitrary kernel
* address, which I then leverage to execute arbitrary kernel code.
*
* Greets to spender, cloud, jono, kees, pipacs, redpig, taviso, twiz, stealth,
* and bla.
*
reseeding code leads to a reduction in entropy.
CVE-2007-5093
Alex Smith discovered an issue with the pwc driver for certain webcam
devices. If the device is removed while a userspace application has it
open, the driver will wait for userspace to close the device, resulting
in a blocked USB subsystem. This issue is of low security impact as
it requires the attacker to either have physical access to the system
or to convince a user with local access to remove the device on their
behalf.
Venus. The arguments to a Coda ioctl are encapsulated in a PioctlData struct,
which in turn contains a ViceIoctl struct. The ViceIoctl struct contains
"in_size" and "out_size" fields, dictating the expected size of the input and
output data corresponding to a particular ioctl request. The "in_size" field
is validated to prevent memory corruption via copying an unexpected amount of
data from userspace into a kernel buffer.
However, the "out_size" field was missing this validation. When copying the
output data of an ioctl request back to userspace, the "out_size" field was
used to determine the amount of data to copy, without restricting it to a
maximum possible size. By specifying a large value for this field, the
this DSA.
CVE-2007-5093
Alex Smith discovered an issue with the pwc driver for certain webcam
devices. If the device is removed while a userspace application has it
open, the driver will wait for userspace to close the device, resulting
in a blocked USB subsystem. This issue is of low security impact as
it requires the attacker to either have physical access to the system
or to convince a user with local access to remove the device on their
behalf.
this DSA.
CVE-2007-5093
Alex Smith discovered an issue with the pwc driver for certain webcam
devices. If the device is removed while a userspace application has it
open, the driver will wait for userspace to close the device, resulting
in a blocked USB subsystem. This issue is of low security impact as
it requires the attacker to either have physical access to the system
or to convince a user with local access to remove the device on their
behalf.
> * -------------
> * This is the interesting one, and the reason I wrote this exploit. If a
> * thread is created via clone(2) using the CLONE_CHILD_CLEARTID flag, a NULL
> * word will be written to a user-specified pointer when that thread exits.
> * This write is done using put_user(), which ensures the provided destination
> * resides in valid userspace by invoking access_ok(). However, Nelson
> * discovered that when the kernel performs an address limit override via
> * set_fs(KERNEL_DS) and the thread subsequently OOPSes (via BUG, page fault,
> * etc.), this override is not reverted before calling put_user() in the exit
> * path, allowing a user to write a NULL word to an arbitrary kernel address.
> * Note that this issue requires an additional vulnerability to trigger.
reseeding code leads to a reduction in entropy.
CVE-2007-5093
Alex Smith discovered an issue with the pwc driver for certain webcam
devices. If the device is removed while a userspace application has it
open, the driver will wait for userspace to close the device, resulting
in a blocked USB subsystem. This issue is of low security impact as
it requires the attacker to either have physical access to the system
or to convince a user with local access to remove the device on their
behalf.
parameter). This bug can be exploited by surreptitiously registering a
callback or "hook" that will cleverly modify parameters passed by the
kernel into userland that are then reused when returning to kernel
from the callback.
In normal execution when the 'CreateWindow' is called from userspace,
the 'NtUserCreateWindowEx' kernel function is executed, the
'xxxCreateWindowEx' is next in the kernel-side call stack. The later
function then checks that the callback functions (or "hooks") where
properly set and calls 'xxxCallHook' which then starts the dispatch
into userland of the registered callback functions.
the amd64 linux-image flavour.
CVE-2007-5093
Alex Smith discovered an issue with the pwc driver for certain webcam
devices. If the device is removed while a userspace application has it
open, the driver will wait for userspace to close the device, resulting
in a blocked USB subsystem. This issue is of low security impact as
it requires the attacker to either have physical access to the system
or to convince a user with local access to remove the device on their
behalf.
via a crafted SKB length value in a runt IEEE 802.11 frame when
the IEEE80211_STYPE_QOS_DATA flag is set, aka an off-by-two
error. (CVE-2007-4997)
The disconnect method in the Philips USB Webcam (pwc) driver in Linux
kernel 2.6.x before 2.6.22.6 relies on user space to close the device,
which allows user-assisted local attackers to cause a denial of service
(USB subsystem hang and CPU consumption in khubd) by not closing the
device after the disconnect is invoked. NOTE: this rarely crosses
privilege boundaries, unless the attacker can convince the victim to
unplug the affected device. (CVE-2007-5093)
error_kernelspace:
incl %ebx
/* There are two places in the kernel that can potentially fault with
usergs. Handle them here. The exception handlers after
iret run with kernel gs again, so don't set the user space flag.
... */
leaq iret_label(%rip),%rbp
cmpq %rbp,RIP(%rsp)
je error_swapgs
...
Debian-specific: no
CVE Id(s) : CVE-2008-2232
Debian Bug : 490921
Anders Kaseorg discovered that afuse, an automounting file system
in user-space, did not properly escape meta characters in paths.
This allowed a local attacker with read access to the filesystem to
execute commands as the owner of the filesystem.
For the stable distribution (etch), this problem has been fixed in
version 0.1.1-1+etch1.
SQLite extension found by Stefan Esser that was addressed in PHP 5.2.1
was not fixed correctly (CVE-2007-1887).
Stefan Esser discovered an error in the zend_alter_ini_entry() function
handling a memory_limit violation (CVE-2007-4659). Stefan Esser also
discovered a flaw when handling interruptions with userspace error
handlers that can be exploited to read arbitrary heap memory
(CVE-2007-1883). Disclosure of sensitive memory can also be triggered
due to insufficient boundary checks in the strspn() and strcspn()
functions, an issue discovered by Mattias Bengtsson and Philip Olausson
(CVE-2007-4657)
leakage due to corrupted partition tables.
The kernel automatically evaluates partition tables of storage devices.
This happens independently of whether any auto-mounting is enabled or
not. The code for evaluating OSF partition tables contains a buffer
overflow bug that allows to leak data from the kernel heap to userspace.
Workaround
----------
title: openMosix userspace library stack-based buffer overflow
Discovered by: Jose Carlos Norte
There are a lot of buffer overflows present in the library of the openMosix project, documented at:
http://www.openmosixview.com/docs/openMosixAPI.html
The vulnerable code is in:
- It detects and blocks Arp Poisoning/Spoofing attacks in statically configured networks;
- It detects and blocks Arp Poisoning/Spoofing attacks in dinamically configured (DHCP) networks;
- It detects and blocks unidirectional and bidirectional attacks;
- It manages the network interface into unplug, boot, hibernation and suspension OS features;
- Easily configurable via command line switches, provided that you have root permissions;
- It works in userspace for OS portability reasons;
- Tested against Ettercap, Cain & Abel, dsniff and other tools.
Links:
http://arpon.sourceforge.net
Problem type : remote
Debian-specific: no
CVE ID : CVE-2011-0001
Emmanuel Bouillon discovered a double free in tgt, the Linux SCSI target
user-space tools, which could lead to denial of service.
The oldstable distribution (lenny) doesn't include tgt.
For the stable distribution (squeeze), this problem has been fixed in
version 1:1.0.4-2squeeze1.
> *
> * How can you accomplish this insidious feat? You immediately discard
>the
> * notion of looking for uninitialized struct members that are copied
>back to
> * userspace, since you clearly need something far more elite. In order
>to
> * prove your superiority, your exploit must be as sophisticated as your
>taste
> * in obscure electronic music. After scanning the kernel source for good
> * candidates, you find your target and begin to code...
CVE-2007-6417
Hugh Dickins discovered an issue in the tmpfs filesystem where, under
a rare circumstance, a kernel page maybe improperly cleared, leaking
sensitive kernel memory to userspace or resulting in a DoS (crash).
These problems have been fixed in the stable distribution in version
2.6.18.dfsg.1-13etch6.
The following matrix lists additional packages that were rebuilt for
Security vulnerabilities have been identified and fixed in udev.
udev before 1.4.1 does not verify whether a NETLINK message originates
from kernel space, which allows local users to gain privileges by
sending a NETLINK message from user space (CVE-2009-1185).
Buffer overflow in the util_path_encode function in
udev/lib/libudev-util.c in udev before 1.4.1 allows local users to
cause a denial of service (service outage) via vectors that trigger
a call with crafted arguments (CVE-2009-1186).
Windows. The ability to make a system call is required in order to
exploit this vulnerability.
The specific flaw exists within the kernel's support for Trace Events.
Due to a bad type conversion, the kernel will use a truncated length for
allocating data from userspace. When populating this buffer the kernel
will use a differing length causing a buffer overflow. This will cause
memory corruption and can lead to code execution under the context of
the kernel.
-- Vendor Response:
Security vulnerabilities have been identified and fixed in udev.
udev before 1.4.1 does not verify whether a NETLINK message originates
from kernel space, which allows local users to gain privileges by
sending a NETLINK message from user space (CVE-2009-1185).
Buffer overflow in the util_path_encode function in
udev/lib/libudev-util.c in udev before 1.4.1 allows local users to
cause a denial of service (service outage) via vectors that trigger
a call with crafted arguments (CVE-2009-1186).
CVE-2008-5395
Helge Deller discovered a denial of service condition that allows
local users on PA-RISC to crash the system by attempting to unwind
a stack containing userspace addresses.
CVE-2008-5701
Vlad Malov reported an issue on 64-bit MIPS where a local user
could cause a system crash by crafting a malicious binary which
via a crafted SKB length value in a runt IEEE 802.11 frame when
the IEEE80211_STYPE_QOS_DATA flag is set, aka an off-by-two
error. (CVE-2007-4997)
The disconnect method in the Philips USB Webcam (pwc) driver in Linux
kernel 2.6.x before 2.6.22.6 relies on user space to close the device,
which allows user-assisted local attackers to cause a denial of service
(USB subsystem hang and CPU consumption in khubd) by not closing the
device after the disconnect is invoked. NOTE: this rarely crosses
privilege boundaries, unless the attacker can convince the victim to
unplug the affected device. (CVE-2007-5093)
ieee80211_rx function. Remote attackers could send a crafted 802.11
frame and cause a denial of service via crash. (CVE-2007-4997)
Alex Smith discovered an issue with the pwc driver for certain webcam
devices. A local user with physical access to the system could remove
the device while a userspace application had it open and cause the USB
subsystem to block. (CVE-2007-5093)
Scott James Remnant discovered a coding error in ptrace. Local users
could exploit this and cause the kernel to enter an infinite loop.
(CVE-2007-5500)
Problem type : local
Debian-specific: no
CVE Id : CVE-2009-3297
Debian Bug : 567633
Dan Rosenberg discovered a race condition in FUSE, a Filesystem in USErspace.
A local attacker, with access to use FUSE, could unmount arbitrary
locations, leading to a denial of service.
For the oldstable distribution (etch), this problem has been fixed in
Next Page>>
|
