New issue
Advanced search Search tips

Issue 684625 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Feb 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Linux
Pri: 1
Type: Bug-Security



Sign in to add a comment

Security: CVE-2017-0403

Project Member Reported by groeck@chromium.org, Jan 24 2017

Issue description

Advisory: CVE-2017-0403
  Details: https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-0403
  CVSS severity score: 7.6/10.0
  Confidence: high
  Description:

An elevation of privilege vulnerability in the kernel performance subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. Product: Android. Versions: Kernel-3.10, Kernel-3.18. Android ID: A-32402548.
 

Comment 1 by est...@chromium.org, Jan 30 2017

Labels: Security_Impact-Stable
groeck: I'm wondering if you could clarify the status on this and  issue 684626 . Are you tracking a fix? Thanks.

Comment 2 by groeck@chromium.org, Jan 30 2017

#1: Yes for both. I was waiting for feedback from the Android team if the fixes for CVE-2017-0403 and CVE-2017-0404 will be submitted upstream, to avoid potential conflicts if possible. Unfortunately, I have not heard back. I'll ping again this week.

Comment 3 by xzhou@chromium.org, Feb 1 2017

Labels: Security_Severity-Medium
Labeled as Security_Severity-Medium because the exploitation of this issues requires compromising a privileged process first.
#1: Waiting for code review (CL:439418)



Status: Started (was: Assigned)
Project Member

Comment 6 by bugdroid1@chromium.org, Feb 9 2017

Labels: merge-merged-chromeos-4.4
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/bae6b341d097d5a8d7a280a44b26f78bcb354259

commit bae6b341d097d5a8d7a280a44b26f78bcb354259
Author: John Dias <joaodias@google.com>
Date: Thu Feb 09 00:24:31 2017

CHROMIUM: perf: don't leave group_entry on sibling list (use-after-free)

When perf_group_detach is called on a group leader,
it should empty its sibling list. Otherwise, when
a sibling is later deallocated, list_del_event()
removes the sibling's group_entry from its current
list, which can be the now-deallocated group leader's
sibling list (use-after-free bug).

BUG=b/32402548, chromium:684625
TEST=Build and test image with perf enabled

Change-Id: I99f6bc97c8518df1cb0035814368012ba72ab1f1
Signed-off-by: John Dias <joaodias@google.com>
(cherry-picked from https://android.googlesource.com/kernel/msm
	e50fdd282473d11837fb877fcda5bcf667010e70)
[Rebase note: Do not apply to later kernels unless the PoC
 (see b/32402548) still works. The changes in this area of code
 are so substantial that it is all but impossible to determine
 if the problem has been fixed or not by looking at the code.]
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/439418

[modify] https://crrev.com/bae6b341d097d5a8d7a280a44b26f78bcb354259/kernel/events/core.c

Project Member

Comment 7 by bugdroid1@chromium.org, Feb 9 2017

Labels: merge-merged-chromeos-3.10
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/48c54a06235b5907d8999ea05d5ec54afc8259c1

commit 48c54a06235b5907d8999ea05d5ec54afc8259c1
Author: John Dias <joaodias@google.com>
Date: Thu Feb 09 00:24:39 2017

CHROMIUM: perf: don't leave group_entry on sibling list (use-after-free)

When perf_group_detach is called on a group leader,
it should empty its sibling list. Otherwise, when
a sibling is later deallocated, list_del_event()
removes the sibling's group_entry from its current
list, which can be the now-deallocated group leader's
sibling list (use-after-free bug).

BUG=b/32402548, chromium:684625
TEST=Build and test image with perf enabled

Change-Id: I99f6bc97c8518df1cb0035814368012ba72ab1f1
Signed-off-by: John Dias <joaodias@google.com>
(cherry-picked from https://android.googlesource.com/kernel/msm
	e50fdd282473d11837fb877fcda5bcf667010e70)
[Rebase note: Do not apply to later kernels unless the PoC
 (see b/32402548) still works. The changes in this area of code
 are so substantial that it is all but impossible to determine
 if the problem has been fixed or not by looking at the code.]
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/439402

[modify] https://crrev.com/48c54a06235b5907d8999ea05d5ec54afc8259c1/kernel/events/core.c

Labels: -M-56 -M-57 M-58
Will initially land in M-58.

Project Member

Comment 9 by bugdroid1@chromium.org, Feb 9 2017

Labels: merge-merged-chromeos-3.18
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/837f6d747e4e742004591db772604ed61d608a4c

commit 837f6d747e4e742004591db772604ed61d608a4c
Author: John Dias <joaodias@google.com>
Date: Thu Feb 09 04:31:52 2017

CHROMIUM: perf: don't leave group_entry on sibling list (use-after-free)

When perf_group_detach is called on a group leader,
it should empty its sibling list. Otherwise, when
a sibling is later deallocated, list_del_event()
removes the sibling's group_entry from its current
list, which can be the now-deallocated group leader's
sibling list (use-after-free bug).

BUG=b/32402548, chromium:684625
TEST=Build and test image with perf enabled

Change-Id: I99f6bc97c8518df1cb0035814368012ba72ab1f1
Signed-off-by: John Dias <joaodias@google.com>
(cherry-picked from https://android.googlesource.com/kernel/msm
	e50fdd282473d11837fb877fcda5bcf667010e70)
[Rebase note: Do not apply to later kernels unless the PoC
 (see b/32402548) still works. The changes in this area of code
 are so substantial that it is all but impossible to determine
 if the problem has been fixed or not by looking at the code.]
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/439400
Reviewed-by: Dylan Reid <dgreid@chromium.org>

[modify] https://crrev.com/837f6d747e4e742004591db772604ed61d608a4c/kernel/events/core.c

Project Member

Comment 10 by bugdroid1@chromium.org, Feb 9 2017

Labels: merge-merged-chromeos-3.14
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/a57ecc1f74af3b5b8b6852faff6167d4d6b144f2

commit a57ecc1f74af3b5b8b6852faff6167d4d6b144f2
Author: John Dias <joaodias@google.com>
Date: Thu Feb 09 04:31:45 2017

CHROMIUM: perf: don't leave group_entry on sibling list (use-after-free)

When perf_group_detach is called on a group leader,
it should empty its sibling list. Otherwise, when
a sibling is later deallocated, list_del_event()
removes the sibling's group_entry from its current
list, which can be the now-deallocated group leader's
sibling list (use-after-free bug).

BUG=b/32402548, chromium:684625
TEST=Build and test image with perf enabled

Change-Id: I99f6bc97c8518df1cb0035814368012ba72ab1f1
Signed-off-by: John Dias <joaodias@google.com>
(cherry-picked from https://android.googlesource.com/kernel/msm
	e50fdd282473d11837fb877fcda5bcf667010e70)
[Rebase note: Do not apply to later kernels unless the PoC
 (see b/32402548) still works. The changes in this area of code
 are so substantial that it is all but impossible to determine
 if the problem has been fixed or not by looking at the code.]
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/439401

[modify] https://crrev.com/a57ecc1f74af3b5b8b6852faff6167d4d6b144f2/kernel/events/core.c

Project Member

Comment 11 by bugdroid1@chromium.org, Feb 9 2017

Labels: merge-merged-chromeos-3.8
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/fea3715e6da5c69eec2574eb8168c8e28d51e081

commit fea3715e6da5c69eec2574eb8168c8e28d51e081
Author: John Dias <joaodias@google.com>
Date: Thu Feb 09 04:31:47 2017

CHROMIUM: perf: don't leave group_entry on sibling list (use-after-free)

When perf_group_detach is called on a group leader,
it should empty its sibling list. Otherwise, when
a sibling is later deallocated, list_del_event()
removes the sibling's group_entry from its current
list, which can be the now-deallocated group leader's
sibling list (use-after-free bug).

BUG=b/32402548, chromium:684625
TEST=Build and test image with perf enabled

Change-Id: I99f6bc97c8518df1cb0035814368012ba72ab1f1
Signed-off-by: John Dias <joaodias@google.com>
(cherry-picked from https://android.googlesource.com/kernel/msm
	e50fdd282473d11837fb877fcda5bcf667010e70)
[Rebase note: Do not apply to later kernels unless the PoC
 (see b/32402548) still works. The changes in this area of code
 are so substantial that it is all but impossible to determine
 if the problem has been fixed or not by looking at the code.]
Signed-off-by: Guenter Roeck <groeck@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/439403

[modify] https://crrev.com/fea3715e6da5c69eec2574eb8168c8e28d51e081/kernel/events/core.c

Status: Fixed (was: Started)
Labels: Release-0-M58
Project Member

Comment 14 by sheriffbot@chromium.org, May 18 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment