Issue metadata
Sign in to add a comment
|
CVE-2017-14156 CrOS: Vulnerability reported in Linux kernel |
||||||||||||||||||||||
Issue descriptionVOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. Advisory: CVE-2017-14156 Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-14156 CVSS severity score: 2.1/10.0 Description: The atyfb_ioctl function in drivers/video/fbdev/aty/atyfb_base.c in the Linux kernel through 4.12.10 does not initialize a certain data structure, which allows local users to obtain sensitive information from kernel stack memory by reading locations associated with padding bytes. This bug was filed by http://go/vomit Please contact us at vomit-team@google.com if you need any assistance.
,
Sep 8 2017
Issue 763338 has been merged into this issue.
,
Sep 19 2017
Upstream 8e75f7a7a004 ("video: fbdev: aty: do not leak uninitialized padding in clk to userspace").
,
Sep 19 2017
Will fix in chromeos-3.18 and later only; conflicts in earlier kernels add too much risk, and those kernels are full of information leaks anyway.
,
Sep 19 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/22919b10b70d4271d0bdfaae040c18da0bd84c5c commit 22919b10b70d4271d0bdfaae040c18da0bd84c5c Author: Vladis Dronov <vdronov@redhat.com> Date: Tue Sep 19 22:42:36 2017 UPSTREAM: video: fbdev: aty: do not leak uninitialized padding in clk to userspace 'clk' is copied to a userland with padding byte(s) after 'vclk_post_div' field unitialized, leaking data from the stack. Fix this ensuring all of 'clk' is initialized to zero. BUG= chromium:762904 TEST=Build and run Change-Id: I414c8ad7057bfb560bfd15d5342e45e4ea0edb52 References: https://github.com/torvalds/linux/pull/441 Reported-by: sohu0106 <sohu0106@126.com> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from commit 8e75f7a7a004) Reviewed-on: https://chromium-review.googlesource.com/673367 Reviewed-by: Dmitry Torokhov <dtor@chromium.org> [modify] https://crrev.com/22919b10b70d4271d0bdfaae040c18da0bd84c5c/drivers/video/fbdev/aty/atyfb_base.c
,
Sep 19 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/10b3b7d0ea2634762ef4dff4a3a7ceadf652f1b3 commit 10b3b7d0ea2634762ef4dff4a3a7ceadf652f1b3 Author: Vladis Dronov <vdronov@redhat.com> Date: Tue Sep 19 22:42:38 2017 UPSTREAM: video: fbdev: aty: do not leak uninitialized padding in clk to userspace 'clk' is copied to a userland with padding byte(s) after 'vclk_post_div' field unitialized, leaking data from the stack. Fix this ensuring all of 'clk' is initialized to zero. BUG= chromium:762904 TEST=Build and run Change-Id: I414c8ad7057bfb560bfd15d5342e45e4ea0edb52 References: https://github.com/torvalds/linux/pull/441 Reported-by: sohu0106 <sohu0106@126.com> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from commit 8e75f7a7a004) Reviewed-on: https://chromium-review.googlesource.com/673348 Reviewed-by: Dmitry Torokhov <dtor@chromium.org> [modify] https://crrev.com/10b3b7d0ea2634762ef4dff4a3a7ceadf652f1b3/drivers/video/fbdev/aty/atyfb_base.c
,
Sep 19 2017
The following revision refers to this bug: https://chromium.googlesource.com/chromiumos/third_party/kernel/+/30e775d6aa74b8c95b6de13a11f2c109add09922 commit 30e775d6aa74b8c95b6de13a11f2c109add09922 Author: Vladis Dronov <vdronov@redhat.com> Date: Tue Sep 19 22:42:41 2017 UPSTREAM: video: fbdev: aty: do not leak uninitialized padding in clk to userspace 'clk' is copied to a userland with padding byte(s) after 'vclk_post_div' field unitialized, leaking data from the stack. Fix this ensuring all of 'clk' is initialized to zero. BUG= chromium:762904 TEST=Build and run Change-Id: I414c8ad7057bfb560bfd15d5342e45e4ea0edb52 References: https://github.com/torvalds/linux/pull/441 Reported-by: sohu0106 <sohu0106@126.com> Signed-off-by: Vladis Dronov <vdronov@redhat.com> Signed-off-by: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com> Signed-off-by: Guenter Roeck <groeck@chromium.org> (cherry picked from commit 8e75f7a7a004) Reviewed-on: https://chromium-review.googlesource.com/673347 Reviewed-by: Dmitry Torokhov <dtor@chromium.org> [modify] https://crrev.com/30e775d6aa74b8c95b6de13a11f2c109add09922/drivers/video/fbdev/aty/atyfb_base.c
,
Sep 19 2017
,
Sep 20 2017
,
Dec 27 2017
This bug has been closed for more than 14 weeks. Removing security view restrictions. For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by groeck@chromium.org
, Sep 7 2017Owner: groeck@chromium.org
Status: ExternalDependency (was: Untriaged)