Bug 904012 - (CVE-2014-7825) VUL-0: CVE-2014-7825: kernel: OOB read in perf
VUL-0: CVE-2014-7825: kernel: OOB read in perf
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Tony Jones
Security Team bot
Depends on:
  Show dependency treegraph
Reported: 2014-11-05 12:18 UTC by Johannes Segitz
Modified: 2017-09-20 14:52 UTC (History)
2 users (show)

See Also:
Found By: ---
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Note You need to log in before you can comment on or make changes to this bug.
Description Johannes Segitz 2014-11-05 12:18:14 UTC
Created attachment 612477 [details]

Date: Mon, 3 Nov 2014 22:20:10 +0100
From: Robert Święcki <robert@swiecki.net>
To: linux-distros@vs.openwall.org

1. Perf OOB read - can be used to defeat kASLR IMO - perf.c as a PoC attached

The upper bound of the syscall nr is not checked against the limit
and it leads to oob here (as well as in perf_syscall_exit)
Probably cannot be used for  anything else (except with annoying the
system admin with scary dmesg messages) than finding layout of the
kernel running on the system


Currently there is no decision on the CRD date, maybe it will be release quite quickly since the patch is public. Only the information about the possible exploitation is private. I checked in SLE 12 kernel and it looks like we're vulnerable.
Comment 2 Swamp Workflow Management 2014-11-05 23:00:56 UTC
bugbot adjusting priority
Comment 5 Marcus Meissner 2014-11-10 09:44:20 UTC
1. Perf subsystem oob read in supervisor mode (local DoS) - CVE-2014-7825

The syscall_nr variable is not verified against the upper limit
(NR_syscalls) in the  perf_syscall_enter()/perf_syscall_exit()
functions, making it possible for the subsequent test_bit() function
to fail when trying to access non-present memory pages.


The impact of this bug depends on the value of kernel.panic_on_oops
sysctl. When equal to 1, it becomes local DoS. For other values it can
still aid an attacker with mapping the kernel address space layout
under systems with kASLR enabled.

This issue has been fixed with in the kernel's mainline tree with:

 Author: Rabin Vincent <rabin@rab.in>
 Date:   Wed Oct 29 23:06:58 2014 +0100
Comment 6 Johannes Segitz 2015-04-08 12:07:44 UTC
will this be included in our kernel git branches?
Comment 7 Tony Jones 2015-04-09 01:53:36 UTC
(In reply to Johannes Segitz from comment #6)
> will this be included in our kernel git branches?

Sorry, I forgot to close this.  Fix is already in all necessary branches via bnc#904013.