New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 800711 link

Starred by 1 user

Issue metadata

Status: WontFix
Owner:
Closed: Jan 2018
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 3
Type: Bug-Security



Sign in to add a comment

CVE-2017-17864 CrOS: Vulnerability reported in Linux kernel

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, Jan 10 2018

Issue description

VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. 

Advisory: CVE-2017-17864
  Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-17864
  CVSS severity score: 2.1/10.0
  Description:

kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak."



This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.

 

Comment 1 by groeck@chromium.org, Jan 10 2018

Cc: wonderfly@google.com
Labels: Security_Severity-Low Security_Impact-None M-65 Pri-3
Owner: groeck@chromium.org
Status: WontFix (was: Untriaged)
Possibly fixed as part of f1174f77b50c ("bpf/verifier: rework value tracking"). Either case, only affects systems with BPF_SYSCALL enabled, which is not the case for ChromeOS. If not fixed already, will only address as part of a stable release merge.

Cc: sawlani@google.com
lakitu has BPF_SYSCALL enabled iirc. sawlani@ can take a look maybe.

Comment 3 by groeck@chromium.org, Jan 10 2018

#2: Ah, sorry, I should have checked. Maybe sawlani@ can determine if any of the patches in the series are needed for stable releases.

Comment 4 by sawlani@google.com, Jan 10 2018

It looks like this is exploitable from 4.14 onward:

"Starting with v4.14, this is exploitable by unprivileged users as long as
the unprivileged_bpf_disabled sysctl isn't set.

I do not see any patches in 4.4/4.9 stable series. 
Also on COS we set unprivileged_bpf_disabled. 

Comment 5 by groeck@chromium.org, Jan 10 2018

One of the Debian commits suggests "The upstream fix is definitely post-4.14, probably "bpf: don't prune branches when a scalar is replaced with a pointer" which is already available in chromeos-4.14. The code in chromeos-4.4 looks completely different to the debian code to which the fix is applied; I strongly suspect that the problematic code was introduced only after 4.4.

Comment 6 by sawlani@google.com, Jan 10 2018

@groeck I think so too. Here's is the thread confirming other bpf bug fixes are needed only in 4.14:
http://www.openwall.com/lists/oss-security/2017/12/21/2

Sign in to add a comment