+-------------------------------------------------------------------------------+
| XADV-2013008 Linux Kernel 3.11.7 <= sk_attach_filter Kernel Heap Corruption   |
+-------------------------------------------------------------------------------+

Vulnerable versions:
- linux kernel 3.11.7 <=
Testbed: ubuntu
Type: Local
Impact: Medium
Vendor: http://www.kernel.org
Author: x90c <geinblues *nospam* gmail dot com>
Site: x90c.org

=========
ABSTRACT:
=========

The Linux Socket Filtering is derived from the Berkeley Packet Filter. 
There are some distinct differences between the BSD and Linux Kernel
Filtering.

Linux Socket Filtering (LSF) allows a user-space program to attach a 
filter onto any socket and allow or disallow certain types of data to
come through the socket. LSF follows exactly the same filter code structure 
as the BSD Berkeley Packet Filter (BPF).

The linux kernel has a vulnerability to lead the kernel panic via an
Integer overflow, It occured at sk_attach_filter() in /net/core/filter.c
the sk_attach_filter.


* References:
  [1] https://www.kernel.org/doc/Documentation/networking/filter.txt
  [2] http://www.cs.columbia.edu/~nahum/w6998/lectures/vpk-columbia-nsdi-lsf.pdf


=========
DETAILS:
=========

[~/linux-3.11.7/net/core/filter.c]
----
int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
{
    struct sk_filter *fp, *old_fp;
    // XXX user controllable fprog->len, stored count of filter to attach.
    unsigned int fsize = sizeof(struct sock_filter) * fprog->len;
    int err;

    if (sock_flag(sk, SOCK_FILTER_LOCKED))
        return -EPERM;

    /* Make sure new filter is there and in the right amounts. */
    if (fprog->filter == NULL)
        return -EINVAL;

    // XXX Integer overflow (+ sizeof(*fp)) and causing a little allocation.
    fp = sock_kmalloc(sk, fsize+sizeof(*fp), GFP_KERNEL);
    if (!fp)
        return -ENOMEM;

    // XXX kernel heap corruption occured with fsize with larger value.
    if (copy_from_user(fp->insns, fprog->filter, fsize)) {
        sock_kfree_s(sk, fp, fsize+sizeof(*fp));

...

----


===============
EXPLOIT CODES:
===============
-

=============
PATCH CODES:
=============
-


===============
VENDOR STATUS:
===============
2013/11/19 - I discovered the bug.
2013/11/19 - The advisory released on full-disclosure, bugtraq.


============
DISCLAIMER:
============

The authors reserve the right not to be responsible for the topicality,
correctness, completeness or quality of the information provided in this
document. Liability claims regarding damage caused by the use of any information
provided, including any kind of information which is incomplete or incorrect,
will therefore be rejected.