New issue
Advanced search Search tips

Issue 761615 link

Starred by 1 user
Status: Fixed
Owner:
groeck@chromium.org
Closed: Sep 2017
Cc:
chromeos-kernel-security-bug-access@google.com
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug-Security



Sign in to add a comment

CVE-2017-14051 CrOS: Vulnerability reported in Linux kernel

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, Sep 2 2017 
VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. 

Advisory: CVE-2017-14051
  Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-14051
  CVSS severity score: 4.9/10.0
  Description:

An integer overflow in the qla2x00_sysfs_write_optrom_ctl function in drivers/scsi/qla2xxx/qla_attr.c in the Linux kernel through 4.12.10 allows local users to cause a denial of service (memory corruption and system crash) by leveraging root access.



This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.

Comment 1 by groeck@chromium.org, Sep 2 2017

Labels: Security_Severity-Medium Security_Impact-None M-63 Pri-2
Owner: groeck@chromium.org
Status: ExternalDependency (was: Untriaged)
Depends on CONFIG_SCSI_FC_ATTRS which is not set in Chromeos builds. No security impact for ChromeOS users. Will fix but not in stable branches.

Reference: https://patchwork.kernel.org/patch/9929625/

Fix is not yet upstream;  Will apply fix after it is available upstream.

Comment 2 by groeck@chromium.org, Sep 11 2017

Status: Started (was: ExternalDependency)
Project Member

Comment 3 by bugdroid1@chromium.org, Sep 12 2017

Labels: merge-merged-chromeos-3.8
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/a6a206f584240b54927579ae67cd21467f625c1e

commit a6a206f584240b54927579ae67cd21467f625c1e
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue Sep 12 17:30:29 2017

UPSTREAM: scsi: qla2xxx: Fix an integer overflow in sysfs code

The value of "size" comes from the user.  When we add "start + size" it
could lead to an integer overflow bug.

It means we vmalloc() a lot more memory than we had intended.  I believe
that on 64 bit systems vmalloc() can succeed even if we ask it to
allocate huge 4GB buffers.  So we would get memory corruption and likely
a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().

Only root can trigger this bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061

BUG= chromium:761615 
TEST=Build and run

Change-Id: I00e345983bf5f86cc0c654cb113180faa7b68be7
Cc: <stable@vger.kernel.org>
Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.")
Reported-by: shqking <shqking@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit e6f77540c067)
Reviewed-on: https://chromium-review.googlesource.com/661140

[modify] https://crrev.com/a6a206f584240b54927579ae67cd21467f625c1e/drivers/scsi/qla2xxx/qla_attr.c
Project Member

Comment 4 by bugdroid1@chromium.org, Sep 12 2017

Labels: merge-merged-chromeos-3.10
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/b2d7afb0a12bce30da6888353d87f34d0dade18e

commit b2d7afb0a12bce30da6888353d87f34d0dade18e
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue Sep 12 17:30:25 2017

UPSTREAM: scsi: qla2xxx: Fix an integer overflow in sysfs code

The value of "size" comes from the user.  When we add "start + size" it
could lead to an integer overflow bug.

It means we vmalloc() a lot more memory than we had intended.  I believe
that on 64 bit systems vmalloc() can succeed even if we ask it to
allocate huge 4GB buffers.  So we would get memory corruption and likely
a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().

Only root can trigger this bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061

BUG= chromium:761615 
TEST=Build and run

Change-Id: I00e345983bf5f86cc0c654cb113180faa7b68be7
Cc: <stable@vger.kernel.org>
Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.")
Reported-by: shqking <shqking@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit e6f77540c067)
Reviewed-on: https://chromium-review.googlesource.com/661139

[modify] https://crrev.com/b2d7afb0a12bce30da6888353d87f34d0dade18e/drivers/scsi/qla2xxx/qla_attr.c
Project Member

Comment 5 by bugdroid1@chromium.org, Sep 12 2017

Labels: merge-merged-chromeos-4.4
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/ad0d33f14baebe677cdf6651533c7ebd8cfecea3

commit ad0d33f14baebe677cdf6651533c7ebd8cfecea3
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue Sep 12 17:30:27 2017

UPSTREAM: scsi: qla2xxx: Fix an integer overflow in sysfs code

The value of "size" comes from the user.  When we add "start + size" it
could lead to an integer overflow bug.

It means we vmalloc() a lot more memory than we had intended.  I believe
that on 64 bit systems vmalloc() can succeed even if we ask it to
allocate huge 4GB buffers.  So we would get memory corruption and likely
a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().

Only root can trigger this bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061

BUG= chromium:761615 
TEST=Build and run

Change-Id: I00e345983bf5f86cc0c654cb113180faa7b68be7
Cc: <stable@vger.kernel.org>
Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.")
Reported-by: shqking <shqking@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit e6f77540c067)
Reviewed-on: https://chromium-review.googlesource.com/660408
Reviewed-by: Dylan Reid <dgreid@chromium.org>

[modify] https://crrev.com/ad0d33f14baebe677cdf6651533c7ebd8cfecea3/drivers/scsi/qla2xxx/qla_attr.c
Project Member

Comment 6 by bugdroid1@chromium.org, Sep 12 2017

Labels: merge-merged-chromeos-3.14
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/3218758148d44e634060418dcffc6e4355e597cc

commit 3218758148d44e634060418dcffc6e4355e597cc
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue Sep 12 20:03:20 2017

UPSTREAM: scsi: qla2xxx: Fix an integer overflow in sysfs code

The value of "size" comes from the user.  When we add "start + size" it
could lead to an integer overflow bug.

It means we vmalloc() a lot more memory than we had intended.  I believe
that on 64 bit systems vmalloc() can succeed even if we ask it to
allocate huge 4GB buffers.  So we would get memory corruption and likely
a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().

Only root can trigger this bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061

BUG= chromium:761615 
TEST=Build and run

Change-Id: I00e345983bf5f86cc0c654cb113180faa7b68be7
Cc: <stable@vger.kernel.org>
Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.")
Reported-by: shqking <shqking@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit e6f77540c067)
Reviewed-on: https://chromium-review.googlesource.com/661138

[modify] https://crrev.com/3218758148d44e634060418dcffc6e4355e597cc/drivers/scsi/qla2xxx/qla_attr.c
Project Member

Comment 7 by bugdroid1@chromium.org, Sep 12 2017

Labels: merge-merged-chromeos-3.18
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/09dccdd256f25e67b656f838b303c261c666bbab

commit 09dccdd256f25e67b656f838b303c261c666bbab
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date: Tue Sep 12 20:03:23 2017

UPSTREAM: scsi: qla2xxx: Fix an integer overflow in sysfs code

The value of "size" comes from the user.  When we add "start + size" it
could lead to an integer overflow bug.

It means we vmalloc() a lot more memory than we had intended.  I believe
that on 64 bit systems vmalloc() can succeed even if we ask it to
allocate huge 4GB buffers.  So we would get memory corruption and likely
a crash when we call ha->isp_ops->write_optrom() and ->read_optrom().

Only root can trigger this bug.

Link: https://bugzilla.kernel.org/show_bug.cgi?id=194061

BUG= chromium:761615 
TEST=Build and run

Change-Id: I00e345983bf5f86cc0c654cb113180faa7b68be7
Cc: <stable@vger.kernel.org>
Fixes: b7cc176c9eb3 ("[SCSI] qla2xxx: Allow region-based flash-part accesses.")
Reported-by: shqking <shqking@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit e6f77540c067)
Reviewed-on: https://chromium-review.googlesource.com/661137

[modify] https://crrev.com/09dccdd256f25e67b656f838b303c261c666bbab/drivers/scsi/qla2xxx/qla_attr.c

Comment 8 by groeck@chromium.org, Sep 12 2017

Status: Fixed (was: Started)
Project Member

Comment 9 by sheriffbot@chromium.org, Sep 13 2017

Labels: Restrict-View-SecurityNotify
Project Member

Comment 10 by sheriffbot@chromium.org, Dec 20 2017

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot
►

Sign in to add a comment