Tiny Core Linux

Tiny Core Base => TCB Bugs => Topic started by: ewindisch on February 09, 2015, 02:27:45 PM

Title: TC busybox vulnerable CVE-2014-9645
Post by: ewindisch on February 09, 2015, 02:27:45 PM

Busybox modprobe allows loading arbitrary modules. This may be triggered via syscalls that load modules automatically based on /proc/sys/kernel/modprobe.


See this:
http://www.openwall.com/lists/oss-security/2015/01/26/1

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: hiro on February 09, 2015, 05:01:22 PM

I would be curious where in tc ifconfig or mount gets run with user-defined content, or are there other ways to exploit this?

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: hiro on February 09, 2015, 05:02:59 PM

Quote from: ewindisch on February 09, 2015, 02:27:45 PM

syscalls that load modules automatically based on /proc/sys/kernel/modprobe.

Can you elaborate about those syscalls? I fail to understand. Sorry.

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: ewindisch on February 09, 2015, 06:01:33 PM

A PoC for userland module loading is provided here: https://lkml.org/lkml/2013/3/4/70

The above issue in CryptoAPI has been fixed, but with a vulnerable busybox modprobe will load arbitrary module modules.

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: hiro on February 09, 2015, 06:14:48 PM

well modprobe doesn't point to a suid busybox here, so it would still relies on cryptoAPI or other helper being "broken", right?

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: ewindisch on February 09, 2015, 07:02:06 PM

Yes, the kernel or a userland application must in some way facilitate this; However, the fact is that the kernel *does* facilitate this as in the CryptoAPI example. The kernel may under certain circumstances call (as root) the binary pointed to by /proc/sys/kernel/modprobe, which on TC is busybox's modprobe.

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: hiro on February 09, 2015, 07:19:26 PM

uuuhh, it's true, I wasn't sure if the crypto api is used or not.
trying it out with that POC is straightforward.
we are affected :(

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: curaga on February 10, 2015, 02:02:33 PM

Can you test 6.1rc1, as it has updated busybox?

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: hiro on February 10, 2015, 02:14:18 PM

I've upgraded my boot files, have yet to reboot. But it really is trivial to test. Do rmmod ac; lsmod|grep ac; then run the compiled POC with ac as argument; lsmod|grep ac will show ac got loaded.

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: curaga on February 10, 2015, 02:28:07 PM

True, but I'm not on TC at the moment.

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: hiro on February 10, 2015, 03:30:17 PM

yep, rc is still vulnerable with new busybox.

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: curaga on February 10, 2015, 04:35:37 PM

Oh, so then there is no busybox release with the fix...

Title: Re: TC busybox vulnerable CVE-2014-9645
Post by: ewindisch on February 13, 2015, 04:45:47 PM

I suppose I should note that the Crypto API had its *own* vulnerability recently fixed in the kernel. It's possible TC is vulnerable to that still.  The vuln exploited by that PoC exploit was never fixed upstream until around December 2014...