oss-sec mailing list archives
CVE-2019-10142 linux kernel: integer overflow in ioctl handling of fsl hypervisor
From: Wade Mealing <wmealing () redhat com>
Date: Thu, 23 May 2019 00:52:17 +1000
Gday,
From the upstream git commit:
"The "param.count" value is a u64 that comes from the user. The code later in the function assumes that param.count is at least one and if it's not then it leads to an Oops when we dereference the ZERO_SIZE_PTR. Also the addition can have an integer overflow which would lead us to allocate a smaller "pages" array than required. I can't immediately tell what the possible run times implications are, but it's safest to prevent the overflow." At this time Red Hat products are not affected this code is not built as the CONFIG_FSL_HV_MANAGER build option is not enabled by default. Device (/dev/fsl-hv) ownership and permissions which prevent unprivileged users from being able to exploit this without some elevated permissions (I think this will default to user: root group:root with 0660 mask) however some Linux distributions may use udev to set this to non root ownership or another group. In the default configuration, a user who is sufficiently privileged to exploit this is likely able to attack the system without it. I open the discussion and note the CVE listed above for discussions that may reference this patch and perhaps save someone some time in investigation. Red Hat bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10142 Upstream fix: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6a024330650e24556b8a18cc654ad00cfecf6c6c -- Wade Mealing Product Security - Kernel, RHCE Red Hat <https://www.redhat.com> wmealing () redhat com <https://red.ht/sig> TRIED. TESTED. TRUSTED. <https://redhat.com/trusted>
Current thread:
- CVE-2019-10142 linux kernel: integer overflow in ioctl handling of fsl hypervisor Wade Mealing (May 22)