Security
The bumpy road to reference-count protection in the kernel
When Kees Cook discussed kernel hardening at the 2016 Kernel Summit, the implementation of reference-count hardening was one of the prominent items on his list of objectives for the coming year. Since then, the topic has been discussed anew on the kernel mailing lists, and reference-count hardening has run into the sorts of problems that security-related patches often encounter: security changes are not always a comfortable fit with the objectives of a general-purpose, widely used kernel. It this case, it looks like the kernel will eventually get reference-count hardening, but not in the form that has been proposed thus far.When reference-count hardening was covered here last July, most of the attention was on a PaX-derived patch set posted by David Windsor. More recently, this patch set has been taken over by Elena Reshetova, who posted a new revision on November 10. The basic approach taken by the patch set has not changed: the kernel's atomic_t type, which is the usual choice for reference-count implementations, is instrumented to detect potential overflows. When an overflow happens, warnings are issued, the offending process is killed, and the affected counter is frozen at a high value so that it will never return to zero. That turns a potential use-after-free vulnerability into a memory leak, hopefully closing off an avenue of attack.
This time around, the patches ran into some stronger opposition, much of which came from core developer Peter Zijlstra. He had two fundamental objections to the approach taken with these patches; the first of those is that they do not preserve the atomic nature of atomic_t, leaving code open to certain kinds of race conditions. This race condition, which was known to Cook and others, could allow an attacker to bypass the reference-count protection. The conclusion that had been reached was that the risk was acceptable and that, in particular, the bypass could still be detected, even if it could not be prevented.
In a sense, the fact that this vulnerability has not been fixed in the hardening patches can be seen as a result of the pressure that developers of security-related patches are under. The vulnerability is easy to close by using a compare-and-swap instruction for reference-count changes, but that would have an adverse effect on performance. Security-related code is hard enough to merge even without performance regressions; in this case, the developers decided to stick with a less-than-perfect implementation to avoid slowing the kernel down. But Zijlstra was adamant that atomic operations must be atomic, even if there is a cost to be paid by users who want the reference-count protection.
The harder problem to solve, though, is tied to the fundamental approach
used by this patch set. It changes the atomic_t implementation on
the assumption that most users are implementing reference counts. It then
becomes necessary to go through the kernel, find all non-reference-count
uses of atomic_t, and switch them to an unprotected variable type.
This approach is necessary, Cook said, to
ensure that all reference-count vulnerabilities have been closed off:
"We need a hardened infrastructure, not just 'stuff people can maybe
remember to use'
". The only way to get there, he said, is with an
opt-out implementation.
The problem with this approach, in the eyes of the core kernel developers, is that it requires an audit of the entire kernel to find the non-reference-count users, and that is an error-prone process at best. Beyond that, atomic_t offers a wide range of operations that are not relevant to reference counts; making them available to developers implementing reference counts is just asking for trouble. In this view, it is far better to create a new type for reference counts, implement overflow protection there, and switch reference-count users over.
Back in June, Jann Horn suggested this approach, using the existing kref type for reference counts. That work didn't get much further at that time, but the approach has returned in the form of a new patch set from Zijlstra. Therein, he creates a new, protected refcount_t type; it is implemented using atomic_t and provides a restricted set of operations. The kref implementation is then reworked to use refcount_t, cleaning up some of the interfaces and users along the way. The intended end result is a well-defined way to implement reference counts in the kernel that is difficult for developers to abuse and which can be protected from overflow vulnerabilities.
The current reference-count hardening patch set from Reshetova touches nearly 400 files; Zijlstra's patch set is far smaller. To a great extent, that is because its ambitions are far lower: it adds an infrastructure for protecting reference counts and implements it for code that was already using the kref type, but does nothing about the vast number of reference-count implementations built directly on atomic_t; that is an exercise left for others to do later. The exercise is straightforward, but it does involve understanding the code in question to be sure that the switch to the new type will not introduce bugs.
Assuming that the kernel adopts Zijlstra's approach — a reasonably safe assumption — it will end up with a reference-count protection mechanism that runs more slowly and, initially, protects far less code than the PaX-derived approach. But it will also get a solution without race-condition worries and which doesn't have the same potential to introduce bugs into code using atomic_t for purposes other than reference counting. Over time, assuming developers devote some time to the task (not always a good assumption, alas), vulnerable code should be switched over and the end result, from a protection point of view, should be the same. For security-related patches, that sort of outcome is often the best-case scenario, even if the developers who put much of their time into the PaX-derived code find it less than fully gratifying.
Brief items
Security quotes of the week
Security experts frequently discover vulnerabilities in consumer electronics, but this case is exceptional. It was not a bug. Rather, Adups intentionally designed the software to help a Chinese phone manufacturer monitor user behavior, according to a document that Adups provided to explain the problem to [phone maker] BLU executives. That version of the software was not intended for American phones, the company said.
In general, the software market demands that products be fast and cheap and that security be a secondary consideration. That was okay when software didn't matter — it was okay that your spreadsheet crashed once in a while. But a software bug that literally crashes your car is another thing altogether. The security vulnerabilities in the Internet of Things are deep and pervasive, and they won't get fixed if the market is left to sort it out for itself. We need to proactively discuss good regulatory solutions; otherwise, a disaster will impose bad ones on us.
Security Exercises (Linux Journal)
Over at Linux Journal, Susan Sons has a lengthy article on security exercises, which are a way to test the readiness of a project or organization for some kind of security problem. "Scheduling exercises at a predictable time and reminding others when it will happen prevents confusion among staff. It is wise to begin with low-impact exercises (more on this below) that don't leverage production systems, and move on to higher-potential-impact exercises only when the organization's infrastructure and personnel have had most of the bugs shaken out. If something as small as a runaway process on a single server can seriously impact your business, it's better to find out at a planned time with all hands on deck than at 4am on a holiday when no one who knows what to do can be reached. The whole point of security exercises is to increase resilience: raise the threshold of what is normal for your team to deal with, what your systems can shrug off." She followed that article up with some example security exercises.
KDE neon users may want to reinstall
The KDE Project has a little problem to report for users of the KDE neon distribution: "The package archive used by KDE neon was incorrectly configured allowing anyone to upload packages to it. There is no reason to think that anyone actually did so but as a precaution we have emptied the archives and removed ISOs built before this date." Once the process of rebuilding the archive is complete, users are recommended to upgrade to the new versions, or, better, simply reinstall.
The "cryptsetup initrd root shell" vulnerability
Hector Marco and Ismael Ripoll report a discouraging vulnerability in many encrypted disk setups: simply running up too many password failures will eventually result in a root shell. "This vulnerability allows to obtain a root initramfs shell on affected systems. The vulnerability is very reliable because it doesn't depend on specific systems or configurations. Attackers can copy, modify or destroy the hard disc as well as set up the network to exfiltrate data. This vulnerability is specially serious in environments like libraries, ATMs, airport machines, labs, etc, where the whole boot process is protect (password in BIOS and GRUB) and we only have a keyboard or/and a mouse."
New vulnerabilities
akonadi: denial of service
| Package(s): | akonadi | CVE #(s): | |||||||||
| Created: | November 16, 2016 | Updated: | November 18, 2016 | ||||||||
| Description: | From the Debian advisory:
In some configurations the MySQL storage backend for Akonadi, an extensible cross-desktop Personal Information Management (PIM) storage service failed to start after applying the MySQL 5.5.53 security upgrade. | ||||||||||
| Alerts: |
| ||||||||||
atomic-openshift: redirect network traffic
| Package(s): | atomic-openshift | CVE #(s): | CVE-2016-8631 | ||||
| Created: | November 16, 2016 | Updated: | November 16, 2016 | ||||
| Description: | From the Red Hat advisory:
The OpenShift Container Platform 3 router does not properly sort routes when processing newly added routes. An attacker with access to create routes can potentially overwrite existing routes and redirect network traffic for other users to their own site. | ||||||
| Alerts: |
| ||||||
chromium-browser: multiple vulnerabilities
| Package(s): | chromium-browser | CVE #(s): | CVE-2016-5199 CVE-2016-5200 CVE-2016-5201 CVE-2016-5202 | ||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 15, 2016 | Updated: | November 29, 2016 | ||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Chromium to crash, execute arbitrary code, or disclose sensitive information when visited by the victim. | ||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||
dracut: information disclosure
| Package(s): | dracut | CVE #(s): | CVE-2016-8637 | ||||||||||||
| Created: | November 10, 2016 | Updated: | November 21, 2016 | ||||||||||||
| Description: | From the Red Hat bugzilla entry:
A local information disclosure issue was found in dracut when generating initramfs images with world-readable permissions when "early cpio" is used, such as when including microcode updates. Local attacker can use this to obtain sensitive information from these files, such as encryption keys or credentials. | ||||||||||||||
| Alerts: |
| ||||||||||||||
firefox: multiple vulnerabilities
| Package(s): | firefox thunderbird | CVE #(s): | CVE-2016-5290 CVE-2016-5291 CVE-2016-5296 CVE-2016-5297 CVE-2016-9064 CVE-2016-9066 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 16, 2016 | Updated: | December 15, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
* Multiple flaws were found in the processing of malformed web content. A web page containing malicious content could cause Firefox to crash or, potentially, execute arbitrary code with the privileges of the user running Firefox. (CVE-2016-5296, CVE-2016-5297, CVE-2016-9066, CVE-2016-5291, CVE-2016-5290) * A flaw was found in the way Add-on update process was handled by Firefox. A Man-in-the-Middle attacker could use this flaw to install a malicious signed add-on update. (CVE-2016-9064) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
gst-plugins-bad0.10: code execution
| Package(s): | gst-plugins-bad | CVE #(s): | CVE-2016-9447 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 16, 2016 | Updated: | December 16, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Debian advisory:
Chris Evans discovered that the GStreamer 0.10 plugin to decode NES
Sound Format files allowed the execution of arbitrary code. Further
details can be found in his advisory at | ||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||
kernel: two vulnerabilities
| Package(s): | kernel | CVE #(s): | CVE-2016-7097 CVE-2016-8666 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 10, 2016 | Updated: | January 31, 2017 | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Mageia advisory:
The filesystem implementation in the Linux kernel through 4.8.2 preserves the setgid bit during a setxattr call, which allows local users to gain group privileges by leveraging the existence of a setgid program with restrictions on execute permissions (CVE-2016-7097). The IP stack in the Linux kernel before 4.6 allows remote attackers to cause a denial of service (stack consumption and panic) or possibly have unspecified other impact by triggering use of the GRO path for packets with tunnel stacking, as demonstrated by interleaved IPv4 headers and GRE headers, a related issue to CVE-2016-7039 (CVE-2016-8666). | ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
libarchive: unspecified
| Package(s): | libarchive | CVE #(s): | |||||
| Created: | November 16, 2016 | Updated: | November 16, 2016 | ||||
| Description: | From the Mageia advisory:
The updated packages might contain additional security fixes if we missed some other ones when we cherry-picked patches against version 3.2.1. | ||||||
| Alerts: |
| ||||||
libgit2: unspecified
| Package(s): | libgit2 | CVE #(s): | |||||||||
| Created: | November 15, 2016 | Updated: | November 21, 2016 | ||||||||
| Description: | libgit2-v0.24.3 fixes unspecified vulnerabilities. See the Red Hat advisory for more information. | ||||||||||
| Alerts: |
| ||||||||||
monit: cross-site request forgery
| Package(s): | monit | CVE #(s): | CVE-2016-7067 | ||||||||||||||||||||
| Created: | November 14, 2016 | Updated: | December 13, 2016 | ||||||||||||||||||||
| Description: | From the Mageia advisory:
The forms in Monit's Service Manager are vulnerable to a cross site request forgery attack. Successful exploitation will enable an attacker to disable/enable all monitoring for a particular host, disable/enable monitoring for a specific service. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
mysql-community-server: multiple unspecified vulnerabilities
| Package(s): | mysql-community-server | CVE #(s): | CVE-2016-5507 CVE-2016-5609 CVE-2016-5627 CVE-2016-8284 CVE-2016-8288 | ||||||||||||||||||||
| Created: | November 14, 2016 | Updated: | November 16, 2016 | ||||||||||||||||||||
| Description: | From the CVE entries:
Unspecified vulnerability in Oracle MySQL 5.6.32 and earlier and 5.7.14 and earlier allows remote administrators to affect availability via vectors related to Server: InnoDB. (CVE-2016-5507) Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to DML. (CVE-2016-5609) Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows remote authenticated users to affect availability via vectors related to Server: InnoDB. (CVE-2016-5627) Unspecified vulnerability in Oracle MySQL 5.6.31 and earlier and 5.7.13 and earlier allows local users to affect availability via vectors related to Server: Replication. (CVE-2016-8284) Unspecified vulnerability in Oracle MySQL 5.6.30 and earlier and 5.7.12 and earlier allows remote authenticated users to affect integrity via vectors related to Server: InnoDB Plugin. (CVE-2016-8288) | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
nss, nss-util: two vulnerabilities
| Package(s): | nss nss-util | CVE #(s): | CVE-2016-5285 CVE-2016-8635 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 16, 2016 | Updated: | November 16, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
* A NULL pointer dereference flaw was found in the way NSS handled invalid Diffie-Hellman keys. A remote client could use this flaw to crash a TLS/SSL server using NSS. (CVE-2016-5285) * It was found that Diffie Hellman Client key exchange handling in NSS was vulnerable to small subgroup confinement attack. An attacker could use this flaw to recover private keys by confining the client DH key to small subgroup of the desired group. (CVE-2016-8635) | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
opera: multiple vulnerabilities
| Package(s): | opera | CVE #(s): | |||||||||
| Created: | November 14, 2016 | Updated: | November 16, 2016 | ||||||||
| Description: | From the openSUSE advisory:
This update to Opera 41.0.2353.56 fixes the following issues:
| ||||||||||
| Alerts: |
| ||||||||||
python-cryptography: bad key generation
| Package(s): | python-cryptography | CVE #(s): | CVE-2016-9243 | ||||||||||||||||||||
| Created: | November 14, 2016 | Updated: | November 29, 2016 | ||||||||||||||||||||
| Description: | From the Mageia advisory:
Fixed a bug where HKDF would return an empty byte-string if used with a length less than algorithm.digest_size. | ||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||
qemu: multiple vulnerabilities
| Package(s): | qemu, qemu-kvm | CVE #(s): | CVE-2016-7421 CVE-2016-7423 CVE-2016-7994 CVE-2016-8668 | ||||||||||||||||||||||||||||||||
| Created: | November 10, 2016 | Updated: | November 16, 2016 | ||||||||||||||||||||||||||||||||
| Description: | From the Ubuntu advisory:
Li Qiang discovered that QEMU incorrectly handled VMWARE PVSCSI paravirtual SCSI bus emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-7156, CVE-2016-7421) Li Qiang discovered that QEMU incorrectly handled LSI SAS1068 host bus emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-7423) Li Qiang discovered that QEMU incorrectly handled the Virtio GPU support. A privileged attacker inside the guest could use this issue to cause QEMU to consume resources, resulting in a denial of service. (CVE-2016-7994) It was discovered that QEMU incorrectly handled Rocker switch emulation support. A privileged attacker inside the guest could use this issue to cause QEMU to crash, resulting in a denial of service. (CVE-2016-8668) | ||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||
rh-mysql56-mysql: privilege escalation
| Package(s): | rh-mysql56-mysql | CVE #(s): | CVE-2016-6664 | ||||||||||||||||||||||||||||||||||||
| Created: | November 15, 2016 | Updated: | January 19, 2017 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
A flaw was found in the way the mysqld_safe script handled creation of error log file. The mysql operating system user could use this flaw to escalate their privileges to root. | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
sudo: privilege escalation
| Package(s): | sudo | CVE #(s): | CVE-2016-7032 | ||||||||||||||||||||||||||||||||||||
| Created: | November 15, 2016 | Updated: | November 16, 2016 | ||||||||||||||||||||||||||||||||||||
| Description: | From the Debian LTS advisory:
It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed system(), popen() or wordexp() C library functions with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges. noexec bypass via system() and popen() | ||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||
sudo: privilege escalation
| Package(s): | sudo | CVE #(s): | CVE-2016-7076 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Created: | November 14, 2016 | Updated: | November 25, 2016 | ||||||||||||||||||||||||||||||||||||||||||||||||||||
| Description: | From the Red Hat advisory:
It was discovered that the sudo noexec restriction could have been bypassed if application run via sudo executed wordexp() C library function with a user supplied argument. A local user permitted to run such application via sudo with noexec restriction could possibly use this flaw to execute arbitrary commands with elevated privileges. | ||||||||||||||||||||||||||||||||||||||||||||||||||||||
| Alerts: |
| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
terminology: command execution
| Package(s): | terminology | CVE #(s): | CVE-2015-8971 | ||||
| Created: | November 14, 2016 | Updated: | November 16, 2016 | ||||
| Description: | From the Debian advisory:
Nicolas Braud-Santoni discovered that incorrect sanitising of character escape sequences in the Terminology terminal emulator may result in the execution of arbitrary commands. | ||||||
| Alerts: |
| ||||||
tre: code execution
| Package(s): | tre | CVE #(s): | CVE-2015-3796 | ||||||||||||||||
| Created: | November 15, 2016 | Updated: | November 16, 2016 | ||||||||||||||||
| Description: | From the CVE entry:
The TRE library in Libc in Apple iOS before 8.4.1 and OS X before 10.10.5 allows context-dependent attackers to execute arbitrary code or cause a denial of service (memory corruption and application crash) via a crafted regular expression, a different vulnerability than CVE-2015-3797 and CVE-2015-3798. | ||||||||||||||||||
| Alerts: |
| ||||||||||||||||||
Page editor: Jake Edge
Next page:
Kernel development>>