Allele Security Intelligence - ASA-2020-00049 – Linux kernel: Kernel stack information leak on s390/s390x platform

Allele Security Alert

ASA-2020-00049

Identifier(s)

ASA-2020-00049, CVE-2020-10773

Title

Kernel stack information leak on s390/s390x platform

Vendor(s)

Linux foundation

Product(s)

Linux kernel

Affected version(s)

Linux kernel version 5.3.x before 5.3.9
Linux kernel version 4.19.x before 4.19.82
Linux kernel version 4.14.x before 4.14.152
Linux kernel version 4.9.x before 4.9.199
Linux kernel version 4.4.x before 4.4.199
Linux kernel version 3.16.x before 3.16.80

Fixed version(s)

Linux kernel version 5.4
Linux kernel version 5.3.9
Linux kernel version 4.19.82
Linux kernel version 4.14.152
Linux kernel version 4.9.199
Linux kernel version 4.4.199
Linux kernel version 3.16.80

Linux kernel versions with the following commit applied:

s390/cmm: fix information leak in cmm_timeout_handler()
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f

Proof of concept

Unknown

Description

In function cmm_timeout_handler() in file arch/s390/mm/cmm.c, there is a logic error which set null byte too far away from user input which means user input won’t be null terminated. And then, kernel stack data will be concatenated with user input and be processed. By querying the result, attacker is able to see the kernel data.

Technical details

The problem is that the NULL terminator was being put too far:

buf[sizeof(buf) - 1] = '\0';

If the user input isn’t NULL terminated and they haven’t initialized the whole buffer then it leads to an info leak. The NULL terminator should be:

buf[len - 1] = '\0';

Credits

Unknown

Reference(s)

Bug 1846380 (CVE-2020-10773) – CVE-2020-10773 kernel: kernel stack information leak on s390/s390x
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10773

s390/cmm: fix information leak in cmm_timeout_handler()
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f

s390/cmm: fix information leak in cmm_timeout_handler()
https://github.com/torvalds/linux/commit/b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f

Linux 5.4
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4

Linux 5.3.9
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9

Linux 4.19.82
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.82

Linux 4.14.152
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.152

Linux 4.9.199
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.199

Linux 4.4.199
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.199

Linux 3.16.80
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.80

CVE-2020-10773 - Red Hat Customer Portal
https://access.redhat.com/security/cve/CVE-2020-10773

CVE-2020-10773 in Ubuntu
https://people.canonical.com/~ubuntu-security/cve/CVE-2020-10773.html

CVE-2020-10773 | SUSE
https://www.suse.com/security/cve/CVE-2020-10773