Linux mct_u232 Nullpointer Dereference
Date: March 4th, 2016
Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg
CVE: not yet assigned
CVSS: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Title: Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid
USB device descriptors (mct_u232_m8 driver)
Severity: Critical. The Kernel panics. A reboot is required.
Ease of Exploitation: Trivial
Vulnerability type: Wrong input validation
Products: RHEL 7.1 including all updates
Kernel-Version: 3.10.0-229.20.1.el7.x86_64 (for debugging-purposes we used the
CentOS Kernel kernel-debuginfo-3.10.0-229.
Vendor: Red Hat
Vendor contacted: November, 12th 2015
PDF of advisory: https://os-s.net/advisories/
Abstract:
The Kernel 3.10.0-229.20.1.el7.x86_64 crashes on presentation of a buggy USB
device requiring the mct_u232_m8 driver.
Detailed product description:
We confirmed the bug on the following system:
RHEL 7.1
Kernel 3.10.0-229.20.1.el7.x86_64
Further products or kernel versions have not been tested.
How reproducible: Always
Actual results: Kernel crashes.
Description:
The bug was found using the USB-fuzzing framework vUSBf from Sergej Schumilo
(github.com/schumilo) using the following device descriptor:
[*] Device-Descriptor
bLength: 0x12
bDescriptorType: 0x1
bcdUSB: 0x200
bDeviceClass: 0x3
bDeviceSubClass: 0x0
bDeviceProtocol: 0x0
bMaxPacketSize: 0x40
idVendor: 0x50d
idProduct: 0x109
bcdDevice: 0x100
iManufacturer: 0x1
iProduct: 0x2
iSerialNumbers: 0x3
bNumConfigurations: 0x1
This is the configuration descriptor containing only one interrupt-endpoint-
descriptor (IN-direction).
The mct_u232 driver assumes that there will be at least two endpoint-
descriptors configured as interrupt-in.
Since there is no sanity check, it is possible that the kernel tries to
dereference a null-pointer.
This results in a crash of the system.
****
$ nm mct_u232.ko.debug | grep mct_u232_port_probe
0000000000000fc0 t mct_u232_port_probe
$ addr2line -e mct_u232.ko.debug 0xFF9
/usr/src/debug/kernel-3.10.0-
****
**** CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/mct_u232.
...
377 static int mct_u232_port_probe(struct usb_serial_port *port)
378 {
379 struct mct_u232_private *priv;
380
381 priv = kzalloc(sizeof(*priv), GFP_KERNEL);
382 if (!priv)
383 return -ENOMEM;
384
385 /* Use second interrupt-in endpoint for reading. */
386 priv->read_urb = port->serial->port[1]->
sanity check -> possible null-pointer dereference */
387 priv->read_urb->context = port;
388
389 spin_lock_init(&priv->lock);
390
391 usb_set_serial_port_data(port, priv);
392
393 return 0;
395 }
...
****
[*] Configuration-Descriptor
bLength: 0x9
bDescriptorType: 0x2
wTotalLength: 0x27
bNumInterfaces: 0x1
bConfigurationValue: 0x1
iConfiguration: 0x0
bmAttributes: 0x0
bMaxPower: 0x31
[*] Interface-Descriptor
bLength: 0x9
bDescriptorType: 0x4
bInterfaceNumber: 0x0
bAlternateSetting: 0x0
bNumEndpoints: 0x3
bInterfaceClass: 0x0
bInterfaceSubClass: 0x0
bInterfaceProtocol: 0x0
[*] Endpoint-Descriptor:
bLength: 0x7
bDescriptorType: 0x5
bEndpointAddress: 0x81 IN-Direction
bmAttribut: 0x3 Interrupt-Transfer
wMaxPacketSize: 0x404
bInterval: 0xc
[*] Endpoint-Descriptor:
bLength: 0x7
bDescriptorType: 0x5
bEndpointAddress: 0x1 OUT-Direction
bmAttribut: 0x2 Bulk-Transfer
wMaxPacketSize: 0x4
bInterval: 0xc
[*] Endpoint-Descriptor:
bLength: 0x7
bDescriptorType: 0x5
bEndpointAddress: 0x82 IN-Direction
bmAttribut: 0x1 Bulk-Transfer
wMaxPacketSize: 0x4
bInterval: 0xc
Proof of Concept:
For a proof of concept, we are providing an Arduino Leonardo firmware file. This
firmware will emulate the defective USB device.
avrdude -v -p ATMEGA32u4 -c avr109 -P /dev/ttyACM0 -b 57600 -U
flash:w:binary.hex
The firmware has been attached to this bug report.
To prevent the automated delivery of the payload, a jumper may be used to
connect port D3 and 3V3!
Severity and Ease of Exploitation:
The vulnerability can be easily exploited. Using our Arduino Leonardo firmware,
only physical access to the system is required.
Vendor Communication:
We contacted Red Hat on the November, 12th 2015.
To this day, no security patch was provided by the vendor.
Since our 90-day Responsible Discourse deadline is expired, we publish this
Security Advisory.
References:
https://bugzilla.redhat.com/
Kernel Stacktrace:
[ 2273.524650] usb 1-1: new full-speed USB device number 2 using xhci_hcd
[ 2273.741789] usb 1-1: New USB device found, idVendor=050d, idProduct=0109
[ 2273.749429] usb 1-1: New USB device strings: Mfr=1, Product=2,
SerialNumber=3
[ 2273.757144] usb 1-1: Product: ĉ
[ 2273.760821] usb 1-1: Manufacturer: ĉ
[ 2273.763500] usb 1-1: SerialNumber: %
[ 2273.768699] usb 1-1: ep 0x81 - rounding interval to 64 microframes, ep desc
says 96 microframes
[ 2273.814069] usbcore: registered new interface driver mct_u232
[ 2273.820979] usbserial: USB Serial support registered for MCT U232
[ 2273.833864] mct_u232 1-1:1.0: MCT U232 converter detected
[ 2273.838511] BUG: unable to handle kernel NULL pointer dereference at
0000000000000158
[ 2273.839330] IP: [<ffffffffa0393ff9>] mct_u232_port_probe+0x39/0x70 [mct_u232]
[ 2273.839330] PGD 0
[ 2273.839330] Oops: 0000 [#1] SMP
[ 2273.839330] Modules linked in: mct_u232(+) ip6t_rpfilter ip6t_REJECT
ipt_REJECT xt_conntrack ebtable_nat ebtable_broute bridge stp llc
ebtable_filter ebtables ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6
nf_nat_ipv6 ip6table_mangle ip6table_security ip6table_raw ip6table_filter
ip6_tables iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat
nf_conntrack iptable_mangle iptable_security iptable_raw iptable_filter
ip_tables bochs_drm ppdev syscopyarea sysfillrect sysimgblt ttm drm_kms_helper
drm pcspkr i2c_piix4 i2c_core serio_raw parport_pc parport xfs libcrc32c
sd_mod sr_mod crc_t10dif cdrom crct10dif_common ata_generic pata_acpi ata_piix
libata e1000 floppy dm_mirror dm_region_hash dm_log dm_mod
[ 2273.839330] CPU: 0 PID: 8890 Comm: systemd-udevd Not tainted
3.10.0-229.14.1.el7.x86_64 #1
[ 2273.839330] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
[ 2273.839330] task: ffff88000f546660 ti: ffff88000f4cc000 task.ti: ffff88000f4cc000
[ 2273.839330] RIP: 0010:[<ffffffffa0393ff9>] [<ffffffffa0393ff9>]
mct_u232_port_probe+0x39/0x70 [mct_u232]
[ 2273.839330] RSP: 0018:ffff88000f4cf908 EFLAGS: 00010286
[ 2273.839330] RAX: ffff88000d9b49a0 RBX: ffff88000c34e800 RCX: 0000000000000000
[ 2273.839330] RDX: 0000000000000000 RSI: ffff88000d9b49a0 RDI: ffff88000c34eab0
[ 2273.839330] RBP: ffff88000f4cf910 R08: 00000000000163c0 R09: ffff88000e401c00
[ 2273.839330] R10: ffffffffa0393fe3 R11: 0000000000000004 R12: 0000000000000000
[ 2273.839330] R13: ffff88000c34e800 R14: ffffffffa0396000 R15: ffffffffa0396000
[ 2273.839330] FS: 00007fb8082b4880(0000) GS:ffff88000fc00000(0000)
knlGS:0000000000000000
[ 2273.839330] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[ 2273.839330] CR2: 0000000000000158 CR3: 000000000f70c000 CR4:
00000000000006f0
[ 2273.839330] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[ 2273.839330] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[ 2273.839330] Stack:
[ 2273.839330] ffff88000c34eab0 ffff88000f4cf940 ffffffff81461cf6 ffff88000c34eab0
[ 2273.839330] ffff88000c34eab0 ffffffffa0396028 ffff88000c34eab0 ffff88000f4cf968
[ 2273.839330] ffffffff813d30d7 ffffffffa0396028 ffff88000c34eab0 ffffffff813d33e0
[ 2273.839330] Call Trace:
[ 2273.839330] [<ffffffff81461cf6>] usb_serial_device_probe+0x56/
[ 2273.839330] [<ffffffff813d30d7>] driver_probe_device+0x87/0x390
[ 2273.839330] [<ffffffff813d33e0>] ? driver_probe_device+0x390/
[ 2273.839330] [<ffffffff813d341b>] __device_attach+0x3b/0x40
[ 2273.839330] [<ffffffff813d0f1b>] bus_for_each_drv+0x6b/0xb0
[ 2273.839330] [<ffffffff813d2fd8>] device_attach+0x88/0xa0
[ 2273.839330] [<ffffffff813d22d8>] bus_probe_device+0x98/0xc0
[ 2273.839330] [<ffffffff813cfd64>] device_add+0x4c4/0x7a0
[ 2273.839330] [<ffffffff81460243>] usb_serial_probe+0x1123/0x1230
[ 2273.839330] [<ffffffff812d649c>] ? ida_get_new_above+0x7c/0x2a0
[ 2273.839330] [<ffffffff811aba6a>] ? kmem_cache_alloc+0x1ba/0x1d0
[ 2273.839330] [<ffffffff8123e5b2>] ? sysfs_addrm_finish+0x42/0xe0
[ 2273.839330] [<ffffffff8123e391>] ? __sysfs_add_one+0x61/0x100
[ 2273.839330] [<ffffffff8141dc04>] usb_probe_interface+0x1c4/
[ 2273.839330] [<ffffffff813d30d7>] driver_probe_device+0x87/0x390
[ 2273.839330] [<ffffffff813d34b3>] __driver_attach+0x93/0xa0
[ 2273.839330] [<ffffffff813d3420>] ? __device_attach+0x40/0x40
[ 2273.839330] [<ffffffff813d0e43>] bus_for_each_dev+0x73/0xc0
[ 2273.839330] [<ffffffff813d2b2e>] driver_attach+0x1e/0x20
[ 2273.839330] [<ffffffff8145ec4b>] usb_serial_register_drivers+
[ 2273.839330] [<ffffffffa0399000>] ? 0xffffffffa0398fff
[ 2273.839330] [<ffffffffa039901e>] usb_serial_module_init+0x1e/
[ 2273.839330] [<ffffffff810020e8>] do_one_initcall+0xb8/0x230
[ 2273.839330] [<ffffffff810dd0ee>] load_module+0x133e/0x1b40
[ 2273.839330] [<ffffffff812f7d60>] ? ddebug_proc_write+0xf0/0xf0
[ 2273.839330] [<ffffffff810d96b3>] ? copy_module_from_fd.isra.42+
[ 2273.839330] [<ffffffff810ddaa6>] SyS_finit_module+0xa6/0xd0
[ 2273.839330] [<ffffffff81614389>] system_call_fastpath+0x16/0x1b
[ 2273.839330] Code: 00 00 48 89 e5 53 48 89 fb 48 8b 3d aa 3e aa e1 e8 9d 7a
e1 e0 48 85 c0 74 38 48 8b 13 48 8d bb b0 02 00 00 48 89 c6 48 8b 52 28 <48>
8b 92 58 01 00 00 48 89 10 48 89 9a b0 00 00 00 c7 40 08 00
[ 2273.839330] RIP [<ffffffffa0393ff9>] mct_u232_port_probe+0x39/0x70 [mct_u232]
[ 2273.839330] RSP <ffff88000f4cf908>
[ 2273.839330] CR2: 0000000000000158
[ 2274.348716] ---[ end trace b239663354a1c556 ]---
[ 2274.356144] Kernel panic - not syncing: Fatal exception
[ 2274.357102] drm_kms_helper: panic occurred, switching back to text console
Komentarų nėra:
Rašyti komentarą