Issue metadata
Sign in to add a comment
|
CVE-2017-17864 CrOS: Vulnerability reported in Linux kernel |
||||||||||||||||||||||
Issue descriptionVOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. Advisory: CVE-2017-17864 Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-17864 CVSS severity score: 2.1/10.0 Description: kernel/bpf/verifier.c in the Linux kernel through 4.14.8 mishandles states_equal comparisons between the pointer data type and the UNKNOWN_VALUE data type, which allows local users to obtain potentially sensitive address information, aka a "pointer leak." This bug was filed by http://go/vomit Please contact us at vomit-team@google.com if you need any assistance.
,
Jan 10 2018
lakitu has BPF_SYSCALL enabled iirc. sawlani@ can take a look maybe.
,
Jan 10 2018
#2: Ah, sorry, I should have checked. Maybe sawlani@ can determine if any of the patches in the series are needed for stable releases.
,
Jan 10 2018
It looks like this is exploitable from 4.14 onward: "Starting with v4.14, this is exploitable by unprivileged users as long as the unprivileged_bpf_disabled sysctl isn't set. I do not see any patches in 4.4/4.9 stable series. Also on COS we set unprivileged_bpf_disabled.
,
Jan 10 2018
One of the Debian commits suggests "The upstream fix is definitely post-4.14, probably "bpf: don't prune branches when a scalar is replaced with a pointer" which is already available in chromeos-4.14. The code in chromeos-4.4 looks completely different to the debian code to which the fix is applied; I strongly suspect that the problematic code was introduced only after 4.4.
,
Jan 10 2018
@groeck I think so too. Here's is the thread confirming other bpf bug fixes are needed only in 4.14: http://www.openwall.com/lists/oss-security/2017/12/21/2 |
|||||||||||||||||||||||
►
Sign in to add a comment |
|||||||||||||||||||||||
Comment 1 by groeck@chromium.org
, Jan 10 2018Labels: Security_Severity-Low Security_Impact-None M-65 Pri-3
Owner: groeck@chromium.org
Status: WontFix (was: Untriaged)
Possibly fixed as part of f1174f77b50c ("bpf/verifier: rework value tracking"). Either case, only affects systems with BPF_SYSCALL enabled, which is not the case for ChromeOS. If not fixed already, will only address as part of a stable release merge.