XADV-2013003 Linux Kernel eCryptfs write_tag_3_packet Heap Buffer Overflow Vulnerability

[x90c <geinblues () gmail com>]

+--------------------------------------------------------------------------------------------+
| XADV-2013003 Linux Kernel eCryptfs write_tag_3_packet Heap Buffer
Overflow Vulnerability   |
+--------------------------------------------------------------------------------------------+

 Vulnerable versions:
 - linux kernel 2.6.18

 Testbed: linux kernel 2.6.18
 Type: Local
 Impact: kernel panic or potential local privelge escalation.
 Vendor: http://www.kernel.org
 Author: x90c <geinblues *nospam* gmail dot com>
 Site: x90c.org


=========
ABSTRACT:
=========

The write_tag_3_packet() in Linux Kernel eCryptfs is vulnerable to heap
buffer overflow.
It lead to kernel panic and potentialy privilege escalation. The
vulnerability occured
with no checks to memory copy length variable in the vulnerable function.


=========
DETAILS:
=========

The ecryptfs_create() in ecryptfs/inode.c called when operation to create
an directory
in the ecryptfs file system. When after ecryptfs_create() called finally to
reach to
the vulnerable point of memcpy in the vulnerable function of
write_tag_3_packet.



[write_tag_3_packet() in ecryptfs/keystore.c]:
----
...


    } else /* no aes, no 0, 24 key size? */
      auth_tok->session_key.encrypted_key_size = crypt_stat->key_size; /*
(1) */

      key_rec->enc_key_size = /* (2) */
          auth_tok->session_key.encrypted_key_size;

      /* vulnerable point (2, 3 arguments usercontrollable) */
      memcpy(key_rec->enc_key, auth_tok->session_key.encrypted_key,
key_rec->enc_key_size);

...
----



If see The vulnerable point, key_rec->enc_key_size is usercontrolable
variable.
(1) Store the crypt_stat->key_size to
authtok->session_key.encrypted_key_size and (2)
store the authtok->session_key.encrypted_key_size to key_rec->enc_key_size.
In other word, the crypt_stat->key_size to the key_rec->enc_key_size
usercontrollable
variable at the vulnerable point.

The Enter to the vulnerable point, no aes and 0, 24 key size.

If can control crypt_stat->key_size variable, lead to the heap buffer
overflow.
First see the call path from ecryptfs_create() in ecryptfs/inode.c to
vulnerable point.



[call path to the vulnerable point]
----
ecryptfs/inode.c::ecryptfs_create()
    +-> ecryptfs/inode.c::ecryptfs_initialize_file()
    |   -> ecryptfs/crypto.c::ecryptfs_new_file_context()
    |
    +-> ecryptfs/inode.c::ecryptfs_write_metadata()
        -> ecryptfs/crypto.c::ecryptfs_write_headers_virt()
           -> ecryptfs/keystore.c::ecryptfs_generate_key_packet_set()
              -> ecryptfs/keystore.c::write_tag_3_packet() (vulnerable
function)
                 -> memcpy(key_rec->enc_key, /* vulnerable point */
                           auth_tok->session_key.encrypted_key,
                           key_rec->enc_key_size); // XXX usercontrolable
key_rec->enc_key_size!
----



The ecryptfs_initialize_file in ecryptfs/inode.c store the
crypt_stat->key_size by
the variable passed to kernel (mount options). In ecryptfs_new_file_context
store mount_crypt_stat->global_default_cipher_key_size to
crypt_stat->key_size.
the global*key_size is the variable can control at the parse mount options.



[ecryptfs/crypto.c]:
----
int ecryptfs_new_file_context(struct dentry *ecryptfs_dentry)
{
...

   crypt_stat->key_size =
        mount_crypt_stat->global_default_cipher_key_size;

...

----



The mount_crypt_stat->global_default_cipher_key_size can be set by parse
option 'ecryptfs_opt_ecryptfs_key_bytes'. (usercontrollable variable)




[ecryptfs/main.c]:
----
static int ecryptfs_parse_options(struct super_block *sb, char *options)
{
...


     case ecryptfs_opt_ecryptfs_key_bytes:
            cipher_key_bytes_src = args[0].from;
            cipher_key_bytes =
                (int)simple_strtol(cipher_key_bytes_src,
                           &cipher_key_bytes_src, 0);
            mount_crypt_stat->global_default_cipher_key_size =
                cipher_key_bytes;
            ecryptfs_printk(KERN_DEBUG,
                    "The mount_crypt_stat "
                    "global_default_cipher_key_size "
                    "set to: [%d]\n", mount_crypt_stat->
                    global_default_cipher_key_size);
            cipher_key_bytes_set = 1;
            break;
----



The memcpy copy size at vulnerable point can be set by usercontrolable
variable
via the 'ecryptfs_opt_ecryptfs_key_bytes' mount option.



----

      /* vulnerable point */
      memcpy(key_rec->enc_key, auth_tok->session_key.encrypted_key,
key_rec->enc_key_size);

----



The second argument also can user controllable, in this advisory just
commented on it.

heap buffer overflow!



===============
EXPLOIT CODES:
===============

-


=============
PATCH CODES:
=============

-


===============
VENDOR STATUS:
===============
2013/11/04 - The vulnerability discovered.
2013/11/04 - Advisory released on full-disclosure, bugtraq, packetstorm,
exploit-db


========
GREETS:
========

my stuffs are more favorite than rebel's stuffs.


============
DISCLAIMER:
============

The authors reserve the right not to be responsible for the topicality,
correctness, completeness or quality of the information provided in this
document. Liability claims regarding damage caused by the use of any
information
provided, including any kind of information which is incomplete or
incorrect,
will therefore be rejected.

Attachment: xadv-2013003.txt
Description:

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/