Bug 861828 - (CVE-2013-4738) VUL-0: CVE-2013-4738: kernel-source: MSM camera driver multiple vulnerabilities
(CVE-2013-4738)
VUL-0: CVE-2013-4738: kernel-source: MSM camera driver multiple vulnerabilities
Status: RESOLVED INVALID
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Major
: ---
Assigned To: E-mail List
Security Team bot
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2014-02-03 13:47 UTC by Victor Pereira
Modified: 2016-04-27 19:11 UTC (History)
3 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Victor Pereira 2014-02-03 13:47:38 UTC
CVE-2013-4738 and CVE-2013-4739

A stack-based buffer overflow and a kernel memory disclosure
vulnerability have been discovered in the system call handlers of the
camera driver.

CVE-2013-4738:
The camera post processing engine (CPP) and video processing engine
(VPE) provide an ioctl system call interface to user space clients for
communication. When processing arguments passed to the
VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO or
VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl subdev handlers, a user
space supplied length value is used to copy memory to a local stack
buffer without proper bounds checking. An application with access to
the respective device nodes can use this flaw to, e.g., elevate
privileges.

Access Vector: local
Security Risk: high
Vulnerability: CWE-121 (stack-based buffer overflow)

CVE-2013-4739:
The Gemini JPEG encoder and the Jpeg1.0 common encoder/decoder engines
of the camera driver are not properly initializing all members of a
structure before copying it to user space. This allows a local
attacker to obtain potentially sensitive information from kernel stack
memory via ioctl system calls.

Access Vector: local
Security Risk: low
Vulnerability: CWE-200 (information exposure)

Affected versions
All Android releases from CAF using a Linux kernel from the following heads:

*PATCHES*


CVE-2013-4738:

https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=c9c81836ee44db9974007d34cf2aaeb1a51a8d45
https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=28385b9c3054c91dca1aa194ffa750550c50f3ce

CVE-2013-4739:

https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8604847927f952cc8e773b97eca24e1060a570f2


References:
http://www.openwall.com/lists/oss-security/2013/10/15/4
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4738
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4738
Comment 1 Swamp Workflow Management 2014-02-04 23:00:12 UTC
bugbot adjusting priority
Comment 2 SMASH SMASH 2014-02-27 13:35:24 UTC
Affected packages:

SLE-11-SP3: kernel-source
SLE-10-SP3-TERADATA: kernel-source
SLE-11-SP1-TERADATA: kernel-source
SLE-11-SP2: kernel-source
Comment 4 Marcus Meissner 2014-03-06 08:46:02 UTC
This seems to be not from mainline, but in some kind of Android branch,
not in mainline.

It is invalid.