Linux Kernel 3.10.28/3.12.9/3.13.1 net/compat.c compat_sys_recvmmsg input validation

CVSS Meta Temp Score CVSS is a standardized scoring system to determine possibilities of attacks. The Temp Score considers temporal factors like disclosure, exploit and countermeasures. The unique Meta Score calculates the average score of different sources to provide a normalized scoring system.	Current Exploit Price (≈) Our analysts are monitoring exploit markets and are in contact with vulnerability brokers. The range indicates the observed or calculated exploit price to be seen on exploit markets. A good indicator to understand the monetary effort required for and the popularity of an attack.	CTI Interest Score Our Cyber Threat Intelligence team is monitoring different web sites, mailing lists, exploit markets and social media networks. The CTI Interest Score identifies the interest of attackers and the security community for this specific vulnerability in real-time. A high score indicates an elevated risk to be targeted for this vulnerability.
7.0	$0-$5k	0.00

Summaryinfo

A vulnerability classified as critical has been found in Linux Kernel 3.10.28/3.12.9/3.13.1. This issue affects the function compat_sys_recvmmsg of the file net/compat.c. The manipulation leads to input validation. This vulnerability is uniquely identified as CVE-2014-0038. Local access is required to approach this attack. Moreover, an exploit is present. It is suggested to install a patch to address this issue.

Detailsinfo

A vulnerability was found in Linux Kernel 3.10.28/3.12.9/3.13.1 (Operating System) and classified as critical. This issue affects the function compat_sys_recvmmsg of the file net/compat.c. The manipulation with an unknown input leads to a input validation vulnerability. Using CWE to declare the problem leads to CWE-20. The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. Impacted is confidentiality, integrity, and availability. The summary by CVE is:

The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.

The bug was discovered 01/31/2014. The weakness was disclosed 01/28/2014 by pageexec as Bug 338594 as confirmed mailinglist post (oss-sec). The advisory is shared at seclists.org. The identification of this vulnerability is CVE-2014-0038 since 12/03/2013. An attack has to be approached locally. Required for exploitation is a simple authentication. Technical details as well as a public exploit are known. The following code is the reason for this vulnerability:

asmlinkage long compat_sys_recvmmsg(int fd,
   struct compat_mmsghdr __user *mmsg,
   unsigned int vlen, unsigned int flags,
   struct compat_timespec __user *timeout)
{
   int datagrams;
   struct timespec ktspec;

   if (flags & MSG_CMSG_COMPAT)
      return -EINVAL;

   if (COMPAT_USE_64BIT_TIME)
      return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
         flags | MSG_CMSG_COMPAT,
         (struct timespec *) timeout);

The advisory points out:

The timeout pointer parameter is provided by userland (hence the __user annotation) but for x32 syscalls it's simply cast to a kernel pointer and is passed to __sys_recvmmsg which will eventually directly dereference it for both reading and writing. Other callers to __sys_recvmmsg properly copy from userland to the kernel first. The impact is a sort of arbitrary kernel write-where-what primitive by unprivileged users where the to-be-written area must contain valid timespec data initially (the first 64 bit long field must be positive and the second one must be < 1G).

A public exploit has been developed by pageexec in ANSI C and been published immediately after the advisory. The exploit is available at exploit-db.com. It is declared as highly functional. We expect the 0-day to have been worth approximately $5k-$25k. The vulnerability scanner Nessus provides a plugin with the ID 72591 (Slackware 14.1 : kernel (SSA:2014-050-03)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Slackware Local Security Checks and running in the context l. The commercial vulnerability scanner Qualys is able to test this issue with plugin 166761 (OpenSuSE Security Update for Kernel (openSUSE-SU-2014:0204-1)).

Applying a patch is able to eliminate this problem. The bugfix is ready for download at seclists.org. A possible mitigation has been published 4 weeks after the disclosure of the vulnerability. The vulnerability will be addressed with the following lines of code:

--- a/net/compat.c  2014-01-20 12:36:54.372997752 +0100
+++ b/net/compat.c      2014-01-28 02:06:59.265506171 +0100
@@ -780,22 +780,25 @@
    if (flags & MSG_CMSG_COMPAT)
       return -EINVAL;

-   if (COMPAT_USE_64BIT_TIME)
-      return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
-         flags | MSG_CMSG_COMPAT,
-         (struct timespec *) timeout);
-
    if (timeout == NULL)
                return __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                      flags | MSG_CMSG_COMPAT, NULL);

-   if (get_compat_timespec(&ktspec, timeout))
+   if (COMPAT_USE_64BIT_TIME) {
+      if (copy_from_user(&ktspec, timeout, sizeof(ktspec)))
+         return -EFAULT;
+      } else if (get_compat_timespec(&ktspec, timeout))
          return -EFAULT;

       datagrams = __sys_recvmmsg(fd, (struct mmsghdr __user *)mmsg, vlen,
                                   flags | MSG_CMSG_COMPAT, &ktspec);
-      if (datagrams > 0 && put_compat_timespec(&ktspec, timeout))
-         datagrams = -EFAULT;
+      if (datagrams > 0) {
+         if (COMPAT_USE_64BIT_TIME) {
+            if (copy_to_user(timeout, &ktspec, sizeof(ktspec)))
+               datagrams = -EFAULT;
+      } else if (put_compat_timespec(&ktspec, timeout))
+         datagrams = -EFAULT;
+   }

    return datagrams;
 }

The mailinglist post contains the following remark:

The bug was introduced by commit http://git.kernel.org/linus/ee4fa23c4b (other uses of COMPAT_USE_64BIT_TIME seem fine) and should affect all kernels since 3.4 (and perhaps vendor kernels if they backported x32 support along with this code). Note that CONFIG_X86_X32_ABI gets enabled at build time and only if CONFIG_X86_X32 is enabled and ld can build x32 executables.

The vulnerability is also documented in the databases at Exploit-DB (31305), Tenable (72591), SecurityFocus (BID 64781†), OSVDB (102749†) and Secunia (SA56549†). The entries VDB-7901, VDB-12786 and VDB-66114 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

Operating System

Vendor

Linux

Name

Kernel

Version

License

open-source

Website

Vendor: https://www.kernel.org/

CPE 2.3info

CPE 2.2info

Video

Open Video | Show More Videos

CVSSv4info

VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv3info

VulDB Meta Base Score: 7.8
VulDB Meta Temp Score: 7.0

VulDB Base Score: 7.8
VulDB Temp Score: 7.0
VulDB Vector: 🔍
VulDB Reliability: 🔍

CVSSv2info

AV	AC	Au	C	I	A
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳
💳	💳	💳	💳	💳	💳

Vector	Complexity	Authentication	Confidentiality	Integrity	Availability
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock
Unlock	Unlock	Unlock	Unlock	Unlock	Unlock

VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍

NVD Base Score: 🔍

Exploitinginfo

Class: Input validation
CWE: CWE-20
CAPEC: 🔍
ATT&CK: 🔍

Physical: Partially
Local: Yes
Remote: No

Availability: 🔍
Access: Public
Status: Highly functional
Author: pageexec
Programming Language: 🔍
Download: 🔍

EPSS Score: 🔍
EPSS Percentile: 🔍

Price Prediction: 🔍
Current Price Estimation: 🔍

0-Day	Unlock	Unlock	Unlock	Unlock
Today	Unlock	Unlock	Unlock	Unlock

Nessus ID: 72591
Nessus Name: Slackware 14.1 : kernel (SSA:2014-050-03)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Context: 🔍
Nessus Port: 🔍

OpenVAS ID: 850566
OpenVAS Name: SuSE Update for kernel openSUSE-SU-2014:0204-1 (kernel)
OpenVAS File: 🔍
OpenVAS Family: 🔍

Qualys ID: 🔍
Qualys Name: 🔍

MetaSploit ID: recvmmsg_priv_esc.rb
MetaSploit Name: Linux Kernel recvmmsg Privilege Escalation
MetaSploit File: 🔍

Exploit-DB: 🔍

Threat Intelligenceinfo

Interest: 🔍
Active Actors: 🔍
Active APT Groups: 🔍

Countermeasuresinfo

Recommended: Patch
Status: 🔍

Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Exploit Delay Time: 🔍

Patch: seclists.org

Timelineinfo

12/03/2013 🔍
12/28/2013 +25 days 🔍
01/28/2014 +31 days 🔍
01/28/2014 +0 days 🔍
01/31/2014 +3 days 🔍
02/03/2014 +3 days 🔍
02/06/2014 +3 days 🔍
02/20/2014 +14 days 🔍
02/20/2014 +0 days 🔍
11/22/2024 +3928 days 🔍

Sourcesinfo

Vendor: kernel.org

Advisory: Bug 338594
Researcher: pageexec
Status: Confirmed
Confirmation: 🔍

CVE: CVE-2014-0038 (🔍)
GCVE (CVE): GCVE-0-2014-0038
GCVE (VulDB): GCVE-100-12137

OVAL: 🔍

SecurityFocus: 64781 - Linux Kernel 'fpu-internal.h' Local Denial of Service Vulnerability
Secunia: 56549
OSVDB: 102749 - CVE-2014-0038 - Linux - Privilege Escalation Issue

scip Labs: https://www.scip.ch/en/?labs.20161013
See also: 🔍

Entryinfo

Created: 02/03/2014 08:57
Updated: 11/22/2024 16:32
Changes: 02/03/2014 08:57 (92), 07/29/2019 20:37 (6), 11/22/2024 16:32 (19)
Complete: 🔍
Cache ID: 216::103

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion

No comments yet. Languages: en.

Please log in to comment.

◂ Previous Overview Next ▸

Do you need the next level of professionalism?

Upgrade your account now!