Re: CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c

[Seth Arnold <seth.arnold () canonical com>]

On Tue, Nov 26, 2013 at 12:57:23AM +0000, Christey, Steven M. wrote:
> Kurt said:
>
> > > The Genlock driver does not properly initialize all members of a
> > > structure before copying it to user space. This allows a local
> > > attacker to obtain potentially sensitive information from kernel
> > > stack memory via ioctl system calls.
> >
> > This should be classified as CWE-200 Information Disclosure, "memory
> > leak" refers to memory being used and not released properly, resulting
> > in out of memory conditions.
>
> In CWE, we discourage the "memory leak" term because it has multiple
> meanings and interpretations: (1) that memory is allocated but never
> released, or (2) that sensitive portions of memory are accidentally
> disclosed to untrusted parties.
>
> This request sounds like variant (2) of the varying uses of the "memory
> leak" term, although Kurt's interpretation seems to be that it's about
> variant (1), which further reinforces my personal desire to see that
> term go away forever.

I wrote a response to Kurt, suggesting that he had mis-diagnosed the
problem but did not send my response when I found that his message said
the same thing mine said once you replace his first ',' with a ';'. Try
this instead:

> > This should be classified as CWE-200 Information Disclosure; "memory
> > leak" refers to memory being used and not released properly, resulting
> > in out of memory conditions.

[Kurt's words with the first comma replaced with a semicolon.]

It's amazing what a difference two pixels can make. :)

> Anyway... Note that, as this issue is described, "information
> disclosure" actually results from a root cause in which certain
> locations are not properly initialized.  Thus CWE-665: Improper
> Initialization (or its child CWE-457 Use of Uninitialized Variable) are
> probably more appropriate characterizations of the core issue; in this
> case, it happens to lead to memory disclosure, but in other cases, it
> might lead to privilege escalation or other consequences (depending on
> how the uninitialized data is used.)

I came up with CWE 212 before I properly parsed Kurt's mail:
CWE-212: Improper Cross-boundary Removal of Sensitive Data

With so much to chose from it's surprising the fix is one line of code. :)


Thanks

Attachment: signature.asc
Description: Digital signature