SecurityTracker.com
Keep Track of the Latest Vulnerabilities
with SecurityTracker!
    Home    |    View Topics    |    Search    |    Contact Us    |   

SecurityTracker
Archives


 
Sign Up
Sign Up for Your FREE Weekly SecurityTracker E-mail Alert Summary
Instant Alerts
Buy our Premium Vulnerability Notification Service to receive customized, instant alerts
Affiliates
Put SecurityTracker Vulnerability Alerts on Your Web Site -- It's Free!
Partners
Become a Partner and License Our Database or Notification Service
Report a Bug
Report a vulnerability that you have found to SecurityTracker
bugs
@
securitytracker.com






Category:   OS (Linux)  >   Linux Kernel Vendors:   kernel.org
Linux Kernel AMD restore_fpu_checking() Bug Lets Local Users Deny Service or Potentially Obtain Root Privileges
SecurityTracker Alert ID:  1029592
SecurityTracker URL:  http://securitytracker.com/id/1029592
CVE Reference:   CVE-2014-1438   (Links to External Site)
Updated:  Jan 28 2014
Original Entry Date:  Jan 13 2014
Impact:   Denial of service via local system, Root access via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  Exploit Included:  Yes  

Description:   A vulnerability was reported in the Linux Kernel. A local user can cause denial of service conditions. A local user may be able to obtain root privileges.

A local user can trigger a floating point exception in restore_fpu_checking() and kill individual tasks or cause the target system to crash.

AMD-based systems are affected.

On some systems, it may be possible for a local user to obtain root privileges.

The original advisory and a demonstration exploit is available at:

http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/

halfdog reported this vulnerability.

Impact:   A local user can cause the target system to crash.

A local user may be able to obtain root privileges.

Solution:   The vendor has issued a source code fix, available at:

http://git.kernel.org/cgit/linux/kernel/git/tip/tip.git/commit/?id=26bef1318adc1b3a530ecc807ef99346db2aa8b0

Vendor URL:  www.kernel.org/ (Links to External Site)
Cause:   Exception handling error
Underlying OS:  

Message History:   None.


 Source Message Contents

Date:  Sat, 28 Dec 2013 22:07:24 +0000
Subject:  [Full-disclosure] vm86 syscall kernel-panic and some more goodies waiting to be analyzed

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

It seems that at least on 32-bit Debian-sid kernel in VirtualBox
guest, [1] triggers a kernel-panic. This simple POC does not allow
privilege escalation although there might be also some time-race
component involved, sometimes similar code seems to access
uninitialized memory or triggers NULL-dereferences. Therefore the
simple POC code could be extended for more extensive testing. See [2]
for more information.

hd

[1]
http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/Virtual86SwitchToEmmsFault.c
[2] http://www.halfdog.net/Security/2013/Vm86SyscallTaskSwitchKernelPanic/

- -- 
http://www.halfdog.net/
PGP: 156A AE98 B91F 0114 FE88  2BD8 C459 9386 feed a bee
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iEYEARECAAYFAlK/S3oACgkQxFmThv7tq+4bWwCfXUEPbsRB48dBuJ8BL6ajiJY6
lb0An3vqZ+lKWE577pHYYOdfbx1OLFDB
=994F
-----END PGP SIGNATURE-----

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/
 
 


Go to the Top of This SecurityTracker Archive Page





Home   |    View Topics   |    Search   |    Contact Us

Copyright 2014, SecurityGlobal.net LLC