Re: CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c

[Ramon de C Valle <rdecvalle () vmware com>]

----- Original Message -----
> From: "Steven M. Christey" <coley () mitre org>
> To: oss-security () lists openwall com
> Sent: Monday, November 25, 2013 10:57:23 PM
> Subject: RE: [oss-security] CVE request: Kernel MSM - Memory leak in drivers/base/genlock.c
>
> Kurt said:
>
> > > The Genlock driver does not properly initialize all members of a
> > > structure before copying it to user space. This allows a local
> > > attacker to obtain potentially sensitive information from kernel
> > > stack memory via ioctl system calls.
> >
> > This should be classified as CWE-200 Information Disclosure, "memory
> > leak" refers to memory being used and not released properly, resulting
> > in out of memory conditions.
>
> In CWE, we discourage the "memory leak" term because it has multiple meanings
> and interpretations: (1) that memory is allocated but never released, or (2)
> that sensitive portions of memory are accidentally disclosed to untrusted
> parties.
>
> This request sounds like variant (2) of the varying uses of the "memory leak"
> term, although Kurt's interpretation seems to be that it's about variant
> (1), which further reinforces my personal desire to see that term go away
> forever.
>
> Anyway... Note that, as this issue is described, "information disclosure"
> actually results from a root cause in which certain locations are not
> properly initialized.  Thus CWE-665: Improper Initialization (or its child
> CWE-457 Use of Uninitialized Variable) are probably more appropriate
> characterizations of the core issue; in this case, it happens to lead to
> memory disclosure, but in other cases, it might lead to privilege escalation
> or other consequences (depending on how the uninitialized data is used.)
I'd rather use "Missing Initialization of Resource (CWE-909)" to "Use of Uninitialized Resource (CWE-908)" to describe 
the chain of primary weaknesses. Although CWE-665 and CWE-909 seem very similar, even the examples—do we have a 
duplicate?

> Note that vulnerabilities can be combinations of 2 or more less-significant
> errors, which in CWE are called chains or composites:
> http://cwe.mitre.org/data/reports/chains_and_composites.html
>
> That is, just like there can be attack chains, there can be vulnerability
> chains.
>
> As vulnerabilities become more and more complex (because the easy stuff is
> slowly getting eliminated), chains and composites are likely to pose more
> and more challenges for vulnerability classification in the future.  The
> Linux kernel is one of those places.
>
> For CVE assignment purposes, we generally try to classify based on the root
> cause, but there is a recognition that opinions may vary widely in this
> area.
>
> - Steve

-- 
Ramon de C Valle
VMware (vSECR) Security Engineering Team