full-disclosure - [FD] SSD Advisory – Linux Kernel AF_PACKET Use-After-Free

Open Source and information security mailing list archives

Date: Tue, 17 Oct 2017 15:00:26 +0300
From: Maor Shwartz <maors@...ondsecurity.com>
To: fulldisclosure@...lists.org
Cc: SecuriTeam Secure Disclosure <ssd@...ondsecurity.com>
Subject: [FD] SSD Advisory – Linux Kernel AF_PACKET Use-After-Free

SSD Advisory – Linux Kernel AF_PACKET Use-After-Free

Full report: https://blogs.securiteam.com/index.php/archives/3484
Twitter: @SecuriTeam_SSD
Weibo: SecuriTeam_SSD

Vulnerabilities summary
The following advisory describes a use-after-free vulnerability found in
Linux Kernel’s implementation of AF_PACKET that can lead to privilege
escalation.

AF_PACKET sockets “allow users to send or receive packets on the device
driver level. This for example lets them to implement their own protocol on
top of the physical layer or to sniff packets including Ethernet and higher
levels protocol headers”

Credit
The vulnerability was discovered by an independent security researcher
which reported this vulnerabilities to Beyond Security’s SecuriTeam Secure
Disclosure program.

Vendor response
“It is quite likely that this is already fixed by:
packet: hold bind lock when rebinding to fanout hook –
http://patchwork.ozlabs.org/patch/813945/

Also relevant, but not yet merged is
packet: in packet_do_bind, test fanout with bind_lock held –
http://patchwork.ozlabs.org/patch/818726/

We verified that this does not trigger on v4.14-rc2, but does trigger when
reverting that first mentioned commit (008ba2a13f2d).”

--
Thanks
Maor Shwartz
Beyond Security
GPG Key ID: 93CC36E2DE7FF514

Download attachment "SSD Advisory – Linux Kernel AF_PACKET Use-After-Free – SecuriTeam Blogs.pdf" of type "application/pdf" (133663 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives