Allele Security Alert
ASA-2020-00049
Identifier(s)
ASA-2020-00049, CVE-2020-10773
Title
Kernel stack information leak on s390/s390x platform
Vendor(s)
Linux foundation
Product(s)
Linux kernel
Affected version(s)
Linux kernel version 5.3.x before 5.3.9
Linux kernel version 4.19.x before 4.19.82
Linux kernel version 4.14.x before 4.14.152
Linux kernel version 4.9.x before 4.9.199
Linux kernel version 4.4.x before 4.4.199
Linux kernel version 3.16.x before 3.16.80
Fixed version(s)
Linux kernel version 5.4
Linux kernel version 5.3.9
Linux kernel version 4.19.82
Linux kernel version 4.14.152
Linux kernel version 4.9.199
Linux kernel version 4.4.199
Linux kernel version 3.16.80
Linux kernel versions with the following commit applied:
s390/cmm: fix information leak in cmm_timeout_handler()
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f
Proof of concept
Unknown
Description
In function cmm_timeout_handler() in file arch/s390/mm/cmm.c, there is a logic error which set null byte too far away from user input which means user input won’t be null terminated. And then, kernel stack data will be concatenated with user input and be processed. By querying the result, attacker is able to see the kernel data.
Technical details
The problem is that the NULL terminator was being put too far:
buf[sizeof(buf) - 1] = '\0';
If the user input isn’t NULL terminated and they haven’t initialized the whole buffer then it leads to an info leak. The NULL terminator should be:
buf[len - 1] = '\0';
Credits
Unknown
Reference(s)
Bug 1846380 (CVE-2020-10773) – CVE-2020-10773 kernel: kernel stack information leak on s390/s390x
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10773
s390/cmm: fix information leak in cmm_timeout_handler()
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f
s390/cmm: fix information leak in cmm_timeout_handler()
https://github.com/torvalds/linux/commit/b8e51a6a9db94bc1fb18ae831b3dab106b5a4b5f
Linux 5.4
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4
Linux 5.3.9
https://cdn.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.3.9
Linux 4.19.82
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.19.82
Linux 4.14.152
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.14.152
Linux 4.9.199
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.9.199
Linux 4.4.199
https://cdn.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.199
Linux 3.16.80
https://cdn.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.80
CVE-2020-10773 - Red Hat Customer Portal
https://access.redhat.com/security/cve/CVE-2020-10773
https://people.canonical.com/~ubuntu-security/cve/CVE-2020-10773.html
CVE-2020-10773 | SUSE
https://www.suse.com/security/cve/CVE-2020-10773
CVE-2020-10773
https://security-tracker.debian.org/tracker/CVE-2020-10773
CVE-2020-10773
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10773
CVE-2020-10773
https://nvd.nist.gov/vuln/detail/CVE-2020-10773
If there is any error in this alert or you wish a comprehensive analysis, let us know.
Last modified: September 16, 2020