{"id":13117,"date":"2018-08-15T14:19:13","date_gmt":"2018-08-15T22:19:13","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/08\/15\/news-6884\/"},"modified":"2018-08-15T14:19:13","modified_gmt":"2018-08-15T22:19:13","slug":"news-6884","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/08\/15\/news-6884\/","title":{"rendered":"SSD Advisory \u2013 Linux Kernel AF_PACKET Use After Free (packet_sock)"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Wed, 15 Aug 2018 05:26:28 +0000<\/strong><\/p>\n

\n
\n

Vulnerability Summary<\/strong>
UAF vulnerability in Linux Kernel\u2019s implementation of AF_PACKET leads to privilege escalation. AF_PACKET sockets allow users to send or receive packets on the device driver level, which lets them implement their own protocol on top of the physical layer or sniffing packets including Ethernet and higher levels protocol and higher levels of the OSI model.<\/p>\n

Credit<\/strong>
An independent security researcher has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

Affected systems<\/strong>
Ubuntu Desktop versions 14.04, 16.04, 17.10, and other Linux distributions with older kernel versions. The vulnerability has been resolved in the latest Linux Kernel version 4.17.11.
<\/span>
Vulnerability Details<\/strong>
A use-after-free can occur due to a race condition between\u00a0fanout_add<\/em>\u00a0from setsockopt and bind on a AF_PACKET socket.<\/p>\n

Although the racing condition has been fixed here: 15fe076edea787807a7cdc168df832544b58eba6#diff-39c49c27f7a70091bcf94cbad241d0eb<\/a>. They failed to see a UAF could occur from the racing issue. The logic is that a packet_sock can be linked via its prot_hook member to one of the ptype_head linked list in \/net\/core\/dev.c. Each list is a list of function callbacks the Linux stack can call when a network packet is received or sent.<\/p>\n

The logic is that a packet_sock can be linked via its prot_hook member to one of the ptype_head linked list in \/net\/core\/dev.c. Each list is a list of function callbacks the Linux stack can call when a network packet is received or sent, as discussed in the first advisory about AF_PACKET (https:\/\/blogs.securiteam.com\/index.php\/archives\/3484<\/a>)<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n

C<\/span><\/div>\n<\/div>\n

<\/div>\n