Linux Kernel video4linux subsystem getsockopt function Kernel Memory Corruption Vulnerability

Release date:
Updated on: 2010-09-17

Affected Systems:
Linux kernel 2.6.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 43239
Cve id: CVE-2010-3081

Linux Kernel is the Kernel used by open source Linux.

In Linux, some calling programs of the compat_alloc_user_space () function (such as the compat_mc_getsockopt () function in net/compat. c) do not perform any verification on the returned memory region, which may cause kernel memory corruption. The following is a vulnerability code segment:

Kgf = compat_alloc_user_space (klen + sizeof (* optlen ));

If (! Access_ OK (VERIFY_READ, gf32, _ COMPAT_GF0_SIZE) |
_ Get_user (interface, & gf32-> gf_interface) |
_ Get_user (fmode, & gf32-> gf_fmode) |
_ Get_user (numsrc, & gf32-> gf_numsrc) |
_ Put_user (interface, & kgf-> gf_interface) |
_ Put_user (fmode, & kgf-> gf_fmode) |
_ Put_user (numsrc, & kgf-> gf_numsrc) |
Copy_in_user (& kgf-> gf_group, & gf32-> gf_group, sizeof (kgf-> gf_group )))
Return-EFAULT;

The value of klen is a non-negative 32-bit integer provided by the user space. This means that the kgf pointer may go back to the high position in the execution kernel space. The gf32 pointer is a valid user address space and the structure content is controlled. Note that the put_user of nocheck is used (access_ OK is not executed), and the controlled value is written into the kgf structure.

<* Source: H. Peter Anvin (hpa@linux.intel.com)

Link: http://secunia.com/advisories/41462/
Http://sota.gen.nz/compat1/
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Http://www.exploit-db.com/download/15024

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Linux
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://git.kernel.org /? P = linux/kernel/git/torvalds/linux-2.6.git; a = commit; h = c41d68a513c71e35a14f66d71782d27a79a81ea6