CVE-2014-3145 in Linux
Summary
by MITRE
The BPF_S_ANC_NLATTR_NEST extension implementation in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 uses the reverse order in a certain subtraction, which allows local users to cause a denial of service (over-read and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr_nest function before the vulnerability was announced.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 06/19/2021
The vulnerability described in CVE-2014-3145 represents a critical buffer over-read flaw within the Linux kernel's Berkeley Packet Filter implementation that affects versions through 3.14.3. This issue resides in the sk_run_filter function located in net/core/filter.c, where the BPF_S_ANC_NLATTR_NEST extension is improperly implemented. The flaw manifests through a critical logical error in arithmetic operations involving subtraction, specifically where the operands are processed in reverse order. This fundamental implementation error creates a scenario where maliciously crafted BPF instructions can trigger unintended memory access patterns that extend beyond allocated buffer boundaries. The vulnerability's impact is particularly concerning as it operates at the kernel level, providing local attackers with the capability to exploit this weakness for system disruption.
The technical nature of this vulnerability stems from improper handling of network packet attribute nesting within the kernel's filtering mechanism. When the sk_run_filter function processes BPF instructions containing the BPF_S_ANC_NLATTR_NEST extension, it performs a subtraction operation with operands in incorrect sequence, leading to calculation errors that result in memory access violations. This improper operand ordering causes the kernel to attempt reading memory locations that are outside the intended buffer boundaries, creating a condition where the system may access unmapped memory regions or memory belonging to other kernel structures. The flaw essentially allows attackers to manipulate the memory access patterns through carefully constructed BPF bytecode, bypassing normal kernel memory protection mechanisms and potentially causing system instability.
From an operational perspective, this vulnerability enables local users to achieve denial of service conditions that can result in complete system crashes or hangs. The over-read behavior occurs when the kernel attempts to process crafted BPF instructions that cause the subtraction operation to compute incorrect memory offsets, leading to access of invalid memory addresses. The impact extends beyond simple system instability as this flaw can potentially be exploited to extract sensitive kernel memory information or cause system crashes that require manual rebooting. The vulnerability's local nature means that any user with access to execute BPF programs can trigger the condition, making it particularly dangerous in multi-user environments or systems where untrusted code execution is possible.
The mitigation strategies for this vulnerability involve applying the appropriate kernel security patches released by the Linux kernel development team. The fix addresses the core issue by correcting the operand order in the subtraction operation within the affected code path, ensuring that the memory access calculations are performed correctly. Organizations should prioritize updating their Linux systems to versions that contain the patched implementation, as the vulnerability affects the core networking functionality of the kernel. Additionally, system administrators should monitor for any potential exploitation attempts and consider implementing additional security controls such as restricting BPF program execution capabilities where possible. The vulnerability demonstrates the importance of thorough code review and testing for arithmetic operations in kernel space, particularly those involving memory management and buffer calculations. This issue aligns with CWE-129, which addresses improper validation of array indices, and represents a classic example of how seemingly minor implementation errors in kernel code can lead to significant security consequences. The ATT&CK framework categorizes this vulnerability under privilege escalation and denial of service tactics, as local users can leverage it to disrupt system operations and potentially gain further access to system resources through subsequent exploitation attempts.