{"id":13461,"date":"2018-09-27T14:19:15","date_gmt":"2018-09-27T22:19:15","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2018\/09\/27\/news-7228\/"},"modified":"2018-09-27T14:19:15","modified_gmt":"2018-09-27T22:19:15","slug":"news-7228","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2018\/09\/27\/news-7228\/","title":{"rendered":"SSD Advisory \u2013 IRDA Linux Driver UAF"},"content":{"rendered":"

Credit to Author: SSD \/ Ori Nimron| Date: Thu, 27 Sep 2018 11:23:40 +0000<\/strong><\/p>\n

\n
\n

Vulnerabilities Summary<\/strong>
The following advisory describes two vulnerabilities in the Linux Kernel. By combining these two vulnerabilities a privilege escalation can be achieved. The two vulnerabilities are quite old and have been around for at least 17 years, quite a few Long Term releases of Linux have them in their kernel. While the assessment of the Linux kernel team is that they only pose a denial of service, that is incorrect, we will provide here proof that they can run code with a bit of effort and some luck (the probability of success of gaining root privileges is above 50%).<\/p>\n

Vendor Response<\/strong>
“Memory leak in the irda_bind function in net\/irda\/af_irda.c and later in drivers\/staging\/irda\/net\/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (memory consumption) by repeatedly binding an AF_IRDA socket. (CVE-2018-6554) The irda_setsockopt function in net\/irda\/af_irda.c and later in drivers\/staging\/irda\/net\/af_irda.c in the Linux kernel before 4.17 allows local users to cause a denial of service (ias_object use-after-free and system crash) or possibly have unspecified other impact via an AF_IRDA socket. (CVE-2018-6555)”<\/p>\n

https:\/\/lists.ubuntu.com\/archives\/kernel-team\/2018-September\/095137.html<\/a><\/p>\n

CVE<\/strong>
CVE-2018-6554
CVE-2018-6555<\/p>\n

Credit<\/strong>
An independent security researcher, Mohamed\u00a0Ghannam,\u00a0has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.
<\/span>
Affected systems<\/strong>
The vulnerability was introduced in 2.4.17 (21 Dec 2001) Affecting all kernel versions up to 4.17 (IrDA subsystem as removed).<\/p>\n

Vulnerability Details<\/strong>
The first bug affects IRDA socket since its birth in Linux Kernel, it relies to the general queue implementation called “hashbin”.<\/p>\n

Bug analysis:<\/p>\n

\t\t<\/p>\n

\n
<\/span> \t\t\t<\/p>\n
\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n
\n
<\/div>\n<\/div>\n<\/div>\n<\/div>\n
<\/div>\n