Linux Kernel up to 3.12.5 drivers/char/lp.c lp_do_ioctl memory corruption

Summaryinfo

A vulnerability, which was classified as problematic, was found in Linux Kernel up to 3.12.5. This affects the function lp_do_ioctl of the file drivers/char/lp.c. The manipulation results in memory corruption. There is not any exploit available. A patch should be applied to remediate this issue.

Detailsinfo

A vulnerability was found in Linux Kernel up to 3.12.5 (Operating System). It has been classified as critical. Affected is the function lp_do_ioctl of the file drivers/char/lp.c. The manipulation with an unknown input leads to a memory corruption vulnerability. CWE is classifying the issue as CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was released 12/19/2013 by Yongjian Xu as CVE request - kernel: char: Int overflow in lp_do_ioctl() as not defined mailinglist post (oss-sec). The advisory is available at seclists.org. The exploitability is told to be difficult. Local access is required to approach this attack. A authentication is required for exploitation. Technical details are known, but there is no available exploit. The reason for this vulnerability is this part of code:

LP_TIME(minor) = arg * HZ/100;

Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. A possible mitigation has been published immediately after the disclosure of the vulnerability. The vulnerability will be addressed with the following lines of code:

diff --git a/drivers/char/lp.c b/drivers/char/lp.c
index 0913d79..c4094c4 100644
--- a/drivers/char/lp.c
+++ b/drivers/char/lp.c
@@ -587,6 +587,8 @@ static int lp_do_ioctl(unsigned int minor, unsigned int cmd,
       return -ENODEV;
    switch ( cmd ) {
       case LPTIME:
+         if (arg > UINT_MAX / HZ)
+            return -EINVAL;
          LP_TIME(minor) = arg * HZ/100;
          break;
       case LPCHAR:

The vulnerability is also documented in the vulnerability database at OSVDB (101608†). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 3.12.0
• 3.12.1
• 3.12.2
• 3.12.3
• 3.12.4
• 3.12.5

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion