Bugzilla – Bug 914423
VUL-0: CVE-2013-7421: kernel: user can use the cryptoapi to autoload any kernel module
Last modified: 2017-09-20 14:41:22 UTC
found/reported by Matthias Krause We fixed this kind of autoloading for the network interfaces, but it has reappeared with the crypto api. https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu The upcoming Linux kernel v3.19 will contain a fix for a vulnerability in the Linux Crypto API that allows unprivileged users to load arbitrary kernel modules. Users only need to bind(2) to an AF_ALG socket with the algorithm name set to the module they want to load. The bug has been introduced in kernel v2.6.38 when the Crypto User API landed ([1], [2] and [3]) and unintentionally made the module loading capability available to unprivileged userspace programs. The issue has been made public almost two years ago ([4]) and has been fixed just recently ([5]). However, the initial version was incomplete and introduced regressions. As it was me who reported the issue back in 2013, I was Cc'ed on the patch submission. While testing the effectiveness of the initial version of the patch, I stumbled over the first flaw -- not handling crypto templates correctly. This means, the patch would prevent loading the vfat.ko module when requesting a cipher named "vfat" but would fail to do so if one would request "vfat(aes)" instead. As the patch was already merged, a follow-up commit needed to fix that ([6]). Still that was not enough to not cause any regressions related to the auto-loading feature of the Crypto API. So yet another commit added the now required module aliases to the remaining modules ([7]). The story could end here as the bug is fixed with those commits in place, but there's "one more thing"... I did my tests with a busybox based system and stumbled over another issue while testing Kees' patches. A bug in the modprobe implementation of busybox allowed circumventing the newly introduced module prefix. If one would request a cipher named "/vfat" it would happily load the vfat.ko module instead of one matching "crypto-/vfat" as requested by the kernel. In fact, busybox's modprobe implementation strips all leading parts including the '/' from the first argument and tries to load that "basename(1)ed" module instead. As other kernel subsystems try to enforce module prefixes too, this bug isn't limited to the Crypto API but extents to filesystems ("mount –t /usbserial ..."), networking ("ifconfig /usbserial ..."), etc. However, those subsystems require some kind of privilege before they would try to load modules -- capability checks but not necessarily CAP_SYS_MODULE. Nonetheless the busybox bug allows to subvert the enforced subsystem module prefix and load arbitrary modules instead. Luckily that issue ([8]) got fixed pretty fast ([9]) and made it into the latest busybox release -- v1.23.0. So, all in all, this initial remark on an otherwise unrelated LKML thread lead to an incomplete fix that, while being tested, uncovered its incompleteness and yet another bug in a completely different code base. Nice bug smashing, I would say ;) [1] https://git.kernel.org/linus/03c8efc1ffeb [2] https://git.kernel.org/linus/fe869cdb89c9 [3] https://git.kernel.org/linus/8ff590903d5f [4] https://lkml.org/lkml/2013/3/4/70 [5] https://git.kernel.org/linus/5d26a105b5a7 [6] https://git.kernel.org/linus/4943ba16bbc2 [7] https://git.kernel.org/linus/3e14dcf7cb80 [8] https://bugs.busybox.net/show_bug.cgi?id=7652 [9] http://git.busybox.net/busybox/commit/?id=4e314faa0a
so for the kernel these 3 commits are relevant [5] https://git.kernel.org/linus/5d26a105b5a7 [6] https://git.kernel.org/linus/4943ba16bbc2 [7] https://git.kernel.org/linus/3e14dcf7cb80 (Note that this is more a hardening measure. Unclear if it will get a CVE.)
bugbot adjusting priority
From: cve-assign@mitre.org Subject: [oss-security] Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 > The Crypto API in the Linux kernel before 3.19 allowed unprivileged users to > load arbitrary kernel modules. > https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu > https://lkml.org/lkml/2013/3/4/70 > https://git.kernel.org/linus/5d26a105b5a73e5635eae0629b42fa0a90e07b7b Use CVE-2013-7421 for the original 2013 discovery by Mathias Krause, with a "Try the code snippet below on a system with CONFIG_CRYPTO_USER_API=y" attack. The scope of CVE-2013-7421 does not include any other parts of the related 2013-03-03 discussion. In particular, the scope of CVE-2013-7421 does not include the general concepts of "making things safer with no real cost" and "Allowing simple, safe, well understood work-arounds" in the https://lkml.org/lkml/2013/3/3/35 post. Also, the scope of CVE-2013-7421 does not include any other security implications, for other subsystems, of the "This isn't the case for filesystems and a few others, unfortunately" observation in the https://lkml.org/lkml/2013/3/3/88 post. > https://git.kernel.org/linus/4943ba16bbc2db05115707b3ff7b4874e9e3c560 Use CVE-2014-9644 for this second discovery in 2014, mentioned in PqFCo4bfrWu as 'stumbled over the first flaw -- not handling crypto templates correctly. This means, the patch would prevent loading the vfat.ko module when requesting a cipher named "vfat" but would fail to do so if one would request "vfat(aes)" instead.' As far as we can tell, this is a discovery of a separate attack vector that wasn't implied by the 2013 post. > https://git.kernel.org/linus/3e14dcf7cb80b34a1f38b55bc96f02d23fdaaaaf This isn't within the scope of either CVE-2013-7421 or CVE-2014-9644. As far as we can tell, it is largely a usability fix. The example mentioned is "This fixes, e.g., requesting 'ecb(blowfish-generic)', which used to work with kernels v3.18 and below." Is there also a security impact if 3e14dcf7cb80b34a1f38b55bc96f02d23fdaaaaf is missing? For example, is it likely that code exists that requests ecb(blowfish-generic) in an environment without 3e14dcf7cb80b34a1f38b55bc96f02d23fdaaaaf, and is able to continue working afterward, but falls back to weak encryption? Finally, here is one more CVE ID for the last issue that PqFCo4bfrWu mentions: > https://bugs.busybox.net/show_bug.cgi?id=7652 > http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b Use CVE-2014-9645. The scope of this CVE ID is the entire problem of path stripping. (In other words, CVE-2014-9645 is not specific to the 'If one would request a cipher named "/vfat"' attack, and is not specific to the Crypto API.) - -- CVE assignment team, MITRE CVE Numbering Authority
busybox security is tracked in bug 914660
Created backports of the three patches from comment#1 and checked them into SLE11 SP3 and SP4. Forgot to mention the CVE in the commits though, sorry.
An update workflow for this issue was started. This issue was rated as important. Please submit fixed packages until 2015-03-05. When done, reassign the bug to security-team@suse.de. https://swamp.suse.de/webswamp/wf/60808
SUSE-SU-2015:0581-1: An update that solves 21 vulnerabilities and has 67 fixes is now available. Category: security (important) Bug References: 771619,816099,829110,833588,833820,846656,853040,856760,864401,864404,864409,864411,865419,875051,876086,876594,877593,882470,883948,884817,887597,891277,894213,895841,896484,900279,900644,902232,902349,902351,902675,903096,903640,904053,904242,904659,904671,905304,905312,905799,906586,907196,907338,907551,907611,907818,908069,908163,908393,908550,908551,908572,908825,909077,909078,909088,909092,909093,909095,909264,909565,909740,909846,910013,910150,910159,910321,910322,910517,911181,911325,911326,912171,912705,913059,914355,914423,914726,915209,915322,915335,915791,915826,916515,916982,917839,917884,920250 CVE References: CVE-2013-7263,CVE-2014-0181,CVE-2014-3687,CVE-2014-3688,CVE-2014-3690,CVE-2014-4608,CVE-2014-7822,CVE-2014-7842,CVE-2014-7970,CVE-2014-8133,CVE-2014-8134,CVE-2014-8160,CVE-2014-8369,CVE-2014-8559,CVE-2014-9090,CVE-2014-9322,CVE-2014-9419,CVE-2014-9420,CVE-2014-9584,CVE-2014-9585,CVE-2015-1593 Sources used: SUSE Linux Enterprise Server 11 SP3 for VMware (src): kernel-bigsmp-3.0.101-0.47.50.1, kernel-default-3.0.101-0.47.50.1, kernel-pae-3.0.101-0.47.50.1, kernel-source-3.0.101-0.47.50.1, kernel-syms-3.0.101-0.47.50.1, kernel-trace-3.0.101-0.47.50.1, kernel-xen-3.0.101-0.47.50.1 SUSE Linux Enterprise Server 11 SP3 (src): kernel-bigsmp-3.0.101-0.47.50.1, kernel-default-3.0.101-0.47.50.1, kernel-ec2-3.0.101-0.47.50.1, kernel-pae-3.0.101-0.47.50.1, kernel-ppc64-3.0.101-0.47.50.1, kernel-source-3.0.101-0.47.50.1, kernel-syms-3.0.101-0.47.50.1, kernel-trace-3.0.101-0.47.50.1, kernel-xen-3.0.101-0.47.50.1, xen-4.2.5_04-0.7.1 SUSE Linux Enterprise High Availability Extension 11 SP3 (src): cluster-network-1.4-2.28.1.7, gfs2-2-0.17.1.7, ocfs2-1.6-0.21.1.7 SUSE Linux Enterprise Desktop 11 SP3 (src): kernel-bigsmp-3.0.101-0.47.50.1, kernel-default-3.0.101-0.47.50.1, kernel-pae-3.0.101-0.47.50.1, kernel-source-3.0.101-0.47.50.1, kernel-syms-3.0.101-0.47.50.1, kernel-trace-3.0.101-0.47.50.1, kernel-xen-3.0.101-0.47.50.1, xen-4.2.5_04-0.7.1 SLE 11 SERVER Unsupported Extras (src): kernel-bigsmp-3.0.101-0.47.50.1, kernel-default-3.0.101-0.47.50.1, kernel-pae-3.0.101-0.47.50.1, kernel-ppc64-3.0.101-0.47.50.1, kernel-xen-3.0.101-0.47.50.1
SUSE-SU-2015:0736-1: An update that solves 21 vulnerabilities and has 69 fixes is now available. Category: security (important) Bug References: 771619,816099,829110,833588,833820,846656,853040,856760,864401,864404,864409,864411,865419,875051,876086,876594,877593,882470,883948,884817,887597,891277,894213,895841,896484,900279,900644,902232,902349,902351,902675,903096,903640,904053,904242,904659,904671,905304,905312,905799,906586,907196,907338,907551,907611,907818,908069,908163,908393,908550,908551,908572,908825,909077,909078,909088,909092,909093,909095,909264,909565,909740,909846,910013,910150,910159,910251,910321,910322,910517,911181,911325,911326,912171,912705,913059,914355,914423,914726,915209,915322,915335,915791,915826,916515,916982,917839,917884,920250,924282 CVE References: CVE-2013-7263,CVE-2014-0181,CVE-2014-3687,CVE-2014-3688,CVE-2014-3690,CVE-2014-4608,CVE-2014-7822,CVE-2014-7842,CVE-2014-7970,CVE-2014-8133,CVE-2014-8134,CVE-2014-8160,CVE-2014-8369,CVE-2014-8559,CVE-2014-9090,CVE-2014-9322,CVE-2014-9419,CVE-2014-9420,CVE-2014-9584,CVE-2014-9585,CVE-2015-1593 Sources used: SUSE Linux Enterprise Real Time Extension 11 SP3 (src): cluster-network-1.4-2.28.1.14, drbd-kmp-8.4.4-0.23.1.14, iscsitarget-1.4.20-0.39.1.14, kernel-rt-3.0.101.rt130-0.33.36.1, kernel-rt_trace-3.0.101.rt130-0.33.36.1, kernel-source-rt-3.0.101.rt130-0.33.36.1, kernel-syms-rt-3.0.101.rt130-0.33.36.1, lttng-modules-2.1.1-0.12.1.13, ocfs2-1.6-0.21.1.14, ofed-1.5.4.1-0.14.1.14