Attachment 16111 Details for Bug 49841

Buffer Overflow in ISO9660 Filesystem Component of Linux Kernel.txt

Buffer Overflow in ISO9660 Filesystem Component of Linux Kernel.txt (text/plain), 3.35 KB, created by Thomas Biege on 2004-02-23 17:09:28 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Thomas Biege

Created: 2004-02-23 17:09:28 UTC

Size: 3.35 KB

patch

obsolete

>Buffer Overflow in ISO9660 Filesystem Component of Linux Kernel
>
>iDEFENSE Security Advisory 02.XX.04:
>
>I. BACKGROUND
>
>Linux is a free Unix-type operating system originally created by Linus Torvalds with the assistance of developers around the world. The The 'isofs' component of the Linux kernel mediates filesystem interactions with ISO-9660 format CD-ROMs.
>
>II. DESCRIPTION
>
>The Linux kernel performs no length checking on symbolic links stored on an ISO9660 filesystem, allowing a malformed CD to perform an arbitrary length overflow in kernel memory. 
>
>Symbolic links on ISO9660 filesystems are supported by the 'Rock Ridge' extension to the standard format. The vulnerability can be triggered by performing a directory listing on a maliciously constructed ISO filesystem, or attempting to access a file via a malformed symlink on such a filesystem. Many distributions allow local users to mount CDs, which makes them potentially vulnerable to local elevation attacks. 
>
>The relevant functions are as follows:
>
>fs/isofs/rock.c: rock_ridge_symlink_readpage()
>fs/isofs/rock.c: get_symlink_chunk()
>
>There is no checking that the total length of the symlink being read is less than the memory space that has been allocated for storing it. By supplying many CE (continuation) records, each with another SL (symlink) chunk, it is possible for an attacker to build an arbitrary length data structure in kernel memory space. 
>
>A proof of concept exploit has been written that allows a local user to gain root level access. It is also possible to cause execution of code with kernel privileges.
>
>III. ANALYSIS
>
>In order to exploit this vulnerability, an attacker must be able to mount a maliciously constructed filesystem. This may be accomplished by the following: 
>
>a. Having an account on the machine to be compromised and inserting a malformed disk. Some distributions allow local users to mount removable media without needing to be root and with some configurations. This happens automatically when a disk is inserted. The proof of concept exploit works from floppy disk as well as CD-ROM. 
>
>If the attacker can reboot the machine from his or her own media or supply command line options to the kernel during the initialization process after rebooting, exploiting this vulnerability may not be necessary to gain further access. In this situation, the attacker will not be able to directly access any encrypted filesystems. 
>
>b. If encrypted virtual filesystems are implemented, and the attacker gains access to an account able to mount one, then an attacker may be able to mount his or her own maliciously formed filesystem via the encryption interface. This would allow them access to any already mounted filesystems. 
>
>c. Being root already. If the attacker has already gained root, but the kernel has some form of patch preventing root being able to perform certain functions, he or she may still be able to mount a filesystem. As the vulnerability occurs in kernel space, it may be possible for them to neutralize the restrictions.
>
>IV. DETECTION
>
>
>V. WORKAROUNDS
>
>
>VI. VENDOR RESPONSE
>
>TBD
>
>
>VII. CVE INFORMATION
>
>TBD
>
>
>VIII. DISCLOSURE TIMELINE
>
>
>January 9, 2004		   Exploit acquired by iDEFENSE
>February 20, 2004 	   Notified vendor
>February 20, 2004	   iDEFENSE clients notified
>
>IX. CREDIT
>
>
>zen-parse (zen-parse at gmx.net), is credited with this discovery.

Actions: View

Attachments on bug 49841: 16111 | 16235 | 16236