Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Sign up
Appearance settings

Commit 9fdeea0

Browse files
linux-exp
1 parent 9ec0ed8 commit 9fdeea0

File tree

17 files changed

+3159
-0
lines changed

17 files changed

+3159
-0
lines changed

‎2016/CVE-2016-2384/README.md‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
CVE-2016-2384
2+
=============
3+
4+
- [CVE-2016-2384](http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2384)
5+
6+
This is a proof-of-concept exploit for the vulnerability in the usb-midi Linux kernel driver ([CVE-2016-2384](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2384)).
7+
Requires physical access to the machine.
8+
Check out [the writeup](https://xairy.github.io/blog/2016/cve-2016-2384) and [the demo video](https://www.youtube.com/watch?v=lfl1NJn1nvo)!
9+
10+
Timeline:
11+
12+
* 13 Feb 2016: the issue reported to security@kernel.org
13+
* 13 Feb 2016: [the fix](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=07d86ca93db7e5cdf4743564d98292042ec21af7) is upstream
14+
* 14 Feb 2016: [a CVE id](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-2384) is assigned
15+
* 22 Feb 2016: [a writeup](https://xairy.github.io/blog/2016/cve-2016-2384) is published

‎2016/CVE-2016-2384/device.txt‎

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
Speed Full
2+
Bus 001 Device 003: ID 058f:6366 Alcor Micro Corp. Multi Flash Reader
3+
Device Descriptor:
4+
bLength 18
5+
bDescriptorType 1
6+
bcdUSB 2.00
7+
bDeviceClass 0 (Defined at Interface level)
8+
bDeviceSubClass 0
9+
bDeviceProtocol 0
10+
bMaxPacketSize0 64
11+
idVendor 0x0763 Midiman
12+
idProduct 0x1002 MidiSport 2x2
13+
bcdDevice 1.00
14+
iManufacturer 1 Generic
15+
iProduct 2 Mass Storage Device
16+
iSerial 3 058F63666471
17+
bNumConfigurations 1
18+
Configuration Descriptor:
19+
bLength 9
20+
bDescriptorType 2
21+
wTotalLength 32
22+
bNumInterfaces 1
23+
bConfigurationValue 1
24+
iConfiguration 0
25+
bmAttributes 0x80
26+
(Bus Powered)
27+
MaxPower 100mA
28+
Interface Descriptor:
29+
bLength 9
30+
bDescriptorType 4
31+
bInterfaceNumber 0
32+
bAlternateSetting 0
33+
bNumEndpoints 0
34+
bInterfaceClass 255 Vendor Specific Class
35+
bInterfaceSubClass 0
36+
bInterfaceProtocol 0
37+
iInterface 0
38+

‎2016/CVE-2016-2384/kasan-raw.txt‎

Lines changed: 171 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,171 @@
1+
[ 25.262415] ==================================================================
2+
[ 25.263553] BUG: KASAN: use-after-free in snd_usbmidi_free+0x92/0xa0 at addr ffff88006a8c5da0
3+
[ 25.264851] Read of size 8 by task kworker/0:2/928
4+
[ 25.265589] =============================================================================
5+
[ 25.266802] BUG kmalloc-512 (Not tainted): kasan: bad access detected
6+
[ 25.267736] -----------------------------------------------------------------------------
7+
[ 25.267736]
8+
[ 25.269137] Disabling lock debugging due to kernel taint
9+
[ 25.269926] INFO: Allocated in snd_usbmidi_create+0xb4/0x1dc0 age=1 cpu=0 pid=928
10+
[ 25.271023] ___slab_alloc+0x44f/0x470
11+
[ 25.271583] __slab_alloc+0x1b/0x30
12+
[ 25.272103] kmem_cache_alloc_trace+0x126/0x160
13+
[ 25.272774] snd_usbmidi_create+0xb4/0x1dc0
14+
[ 25.273399] create_any_midi_quirk+0x38/0x60
15+
[ 25.274033] snd_usb_create_quirk+0x74/0x110
16+
[ 25.274670] usb_audio_probe+0x43b/0x1d40
17+
[ 25.275262] usb_probe_interface+0x42c/0x8c0
18+
[ 25.275894] driver_probe_device+0x4be/0x800
19+
[ 25.276528] __device_attach_driver+0x176/0x220
20+
[ 25.277199] bus_for_each_drv+0x112/0x1b0
21+
[ 25.277804] __device_attach+0x1c6/0x2a0
22+
[ 25.278362] device_initial_probe+0xe/0x10
23+
[ 25.278941] bus_probe_device+0x199/0x240
24+
[ 25.279509] device_add+0x94c/0x1340
25+
[ 25.280020] usb_set_configuration+0xaec/0x1540
26+
[ 25.280663] INFO: Freed in snd_usbmidi_free+0x7f/0xa0 age=1 cpu=0 pid=928
27+
[ 25.281608] __slab_free+0x170/0x290
28+
[ 25.282123] kfree+0x13b/0x150
29+
[ 25.282562] snd_usbmidi_free+0x7f/0xa0
30+
[ 25.283104] snd_usbmidi_create+0x11bc/0x1dc0
31+
[ 25.283702] create_any_midi_quirk+0x38/0x60
32+
[ 25.284323] snd_usb_create_quirk+0x74/0x110
33+
[ 25.284932] usb_audio_probe+0x43b/0x1d40
34+
[ 25.285505] usb_probe_interface+0x42c/0x8c0
35+
[ 25.286121] driver_probe_device+0x4be/0x800
36+
[ 25.286665] __device_attach_driver+0x176/0x220
37+
[ 25.287227] bus_for_each_drv+0x112/0x1b0
38+
[ 25.287725] __device_attach+0x1c6/0x2a0
39+
[ 25.288213] device_initial_probe+0xe/0x10
40+
[ 25.288721] bus_probe_device+0x199/0x240
41+
[ 25.289219] device_add+0x94c/0x1340
42+
[ 25.289677] usb_set_configuration+0xaec/0x1540
43+
[ 25.290319] INFO: Slab 0xffffea0001aa3100 objects=10 used=0 fp=0xffff88006a8c5cb0 flags=0x100000000004080
44+
[ 25.291648] INFO: Object 0xffff88006a8c5cb0 @offset=7344 fp=0xffff88006a8c4330
45+
[ 25.291648]
46+
[ 25.292848] Bytes b4 ffff88006a8c5ca0: 00 00 00 00 49 0a 00 00 33 b8 fb ff 00 00 00 00 ....I...3.......
47+
[ 25.294156] Object ffff88006a8c5cb0: 30 43 8c 6a 00 88 ff ff 20 67 6b 6c 00 88 ff ff 0C.j.... gkl....
48+
[ 25.295231] Object ffff88006a8c5cc0: 60 ca be 6a 00 88 ff ff 40 28 30 83 ff ff ff ff `..j....@(0.....
49+
[ 25.296304] Object ffff88006a8c5cd0: 80 c9 76 6b 00 88 ff ff 80 0e 98 83 ff ff ff ff ..vk............
50+
[ 25.297531] Object ffff88006a8c5ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
51+
[ 25.298791] Object ffff88006a8c5cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
52+
[ 25.300014] Object ffff88006a8c5d00: 00 00 00 00 00 00 00 00 c0 ae 6b 82 ff ff ff ff ..........k.....
53+
[ 25.301237] Object ffff88006a8c5d10: b0 5c 8c 6a 00 88 ff ff 00 00 00 00 ff ff ff ff .\.j............
54+
[ 25.302469] Object ffff88006a8c5d20: ff ff ff ff 00 00 00 00 00 00 00 00 00 00 00 00 ................
55+
[ 25.303695] Object ffff88006a8c5d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
56+
[ 25.304916] Object ffff88006a8c5d40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
57+
[ 25.306135] Object ffff88006a8c5d50: 50 5d 8c 6a 00 88 ff ff 50 5d 8c 6a 00 88 ff ff P].j....P].j....
58+
[ 25.307303] Object ffff88006a8c5d60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
59+
[ 25.308478] Object ffff88006a8c5d70: 01 00 00 00 00 00 00 00 78 5d 8c 6a 00 88 ff ff ........x].j....
60+
[ 25.309649] Object ffff88006a8c5d80: 78 5d 8c 6a 00 88 ff ff 00 00 00 00 00 00 00 00 x].j............
61+
[ 25.310830] Object ffff88006a8c5d90: 00 00 00 00 00 00 00 00 33 10 63 07 01 00 00 00 ........3.c.....
62+
[ 25.312007] Object ffff88006a8c5da0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
63+
[ 25.313176] Object ffff88006a8c5db0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
64+
[ 25.314342] Object ffff88006a8c5dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
65+
[ 25.315511] Object ffff88006a8c5dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
66+
[ 25.316682] Object ffff88006a8c5de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
67+
[ 25.317861] Object ffff88006a8c5df0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
68+
[ 25.318986] Object ffff88006a8c5e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
69+
[ 25.320100] Object ffff88006a8c5e10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
70+
[ 25.321225] Object ffff88006a8c5e20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
71+
[ 25.322355] Object ffff88006a8c5e30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
72+
[ 25.323475] Object ffff88006a8c5e40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
73+
[ 25.324586] Object ffff88006a8c5e50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
74+
[ 25.325706] Object ffff88006a8c5e60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
75+
[ 25.326826] Object ffff88006a8c5e70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
76+
[ 25.327937] Object ffff88006a8c5e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
77+
[ 25.329049] Object ffff88006a8c5e90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
78+
[ 25.330133] Object ffff88006a8c5ea0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
79+
[ 25.331131] CPU: 0 PID: 928 Comm: kworker/0:2 Tainted: G B 4.4.0 #7
80+
[ 25.331922] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.7.5-0-ge51488c-20140602_164612-nilsson.home.kraxel.org 04/01/2014
81+
[ 25.333297] Workqueue: usb_hub_wq hub_event
82+
[ 25.333766] ffff88006a8c4000 ffff88006b616e50 ffffffff819f6215 ffff88006cc02200
83+
[ 25.334622] ffff88006b616e80 ffffffff81431c84 ffff88006cc02200 ffffea0001aa3100
84+
[ 25.335476] ffff88006a8c5cb0 ffff88006a8c5cb0 ffff88006b616ea8 ffffffff81436c7f
85+
[ 25.336326] Call Trace:
86+
[ 25.336602] [<ffffffff819f6215>] dump_stack+0x44/0x5f
87+
[ 25.337162] [<ffffffff81431c84>] print_trailer+0xf4/0x150
88+
[ 25.337764] [<ffffffff81436c7f>] object_err+0x2f/0x40
89+
[ 25.338323] [<ffffffff81438e9d>] kasan_report_error+0x20d/0x520
90+
[ 25.338973] [<ffffffff814353f2>] ? __slab_free+0x1a2/0x290
91+
[ 25.339604] [<ffffffff814385b6>] ? kasan_unpoison_shadow+0x36/0x50
92+
[ 25.340283] [<ffffffff8157dda7>] ? proc_entry_rundown+0xb7/0x190
93+
[ 25.340949] [<ffffffff814392ae>] __asan_report_load8_noabort+0x3e/0x40
94+
[ 25.341681] [<ffffffff826baa72>] ? snd_usbmidi_free+0x92/0xa0
95+
[ 25.342303] [<ffffffff826baa72>] snd_usbmidi_free+0x92/0xa0
96+
[ 25.342899] [<ffffffff826baab2>] snd_usbmidi_rawmidi_free+0x32/0x40
97+
[ 25.343525] [<ffffffff825f2f7f>] snd_rawmidi_free+0x11f/0x170
98+
[ 25.344065] [<ffffffff825f2ffc>] snd_rawmidi_dev_free+0x2c/0x40
99+
[ 25.344617] [<ffffffff825aa565>] __snd_device_free+0x125/0x210
100+
[ 25.345158] [<ffffffff825aad10>] snd_device_free_all+0x80/0xc0
101+
[ 25.345745] [<ffffffff8259b24f>] release_card_device+0x2f/0x130
102+
[ 25.346366] [<ffffffff8202f6e1>] device_release+0x71/0x1e0
103+
[ 25.347086] [<ffffffff819fbd81>] kobject_release+0xc1/0x160
104+
[ 25.348214] [<ffffffff819fb9fe>] kobject_put+0x4e/0xa0
105+
[ 25.349420] [<ffffffff8202fd42>] put_device+0x12/0x20
106+
[ 25.350574] [<ffffffff8259d6ac>] snd_card_free+0xac/0xf0
107+
[ 25.351768] [<ffffffff8259d600>] ? snd_card_free_when_closed+0x30/0x30
108+
[ 25.353218] [<ffffffff826b2374>] ? snd_usb_create_quirk+0x74/0x110
109+
[ 25.354572] [<ffffffff826aff65>] ? snd_usb_audio_create_proc+0x115/0x1e0
110+
[ 25.355887] [<ffffffff8267eb9a>] usb_audio_probe+0x77a/0x1d40
111+
[ 25.357040] [<ffffffff8267e420>] ? snd_usb_create_stream+0x480/0x480
112+
[ 25.357858] [<ffffffff82056ee6>] ? __pm_runtime_set_status+0x496/0x960
113+
[ 25.358472] [<ffffffff82317a8c>] usb_probe_interface+0x42c/0x8c0
114+
[ 25.359039] [<ffffffff8203c79e>] driver_probe_device+0x4be/0x800
115+
[ 25.359602] [<ffffffff8203cda6>] __device_attach_driver+0x176/0x220
116+
[ 25.360186] [<ffffffff8203cc30>] ? __driver_attach+0x150/0x150
117+
[ 25.360731] [<ffffffff82037682>] bus_for_each_drv+0x112/0x1b0
118+
[ 25.361271] [<ffffffff82037570>] ? bus_rescan_devices+0x20/0x20
119+
[ 25.361830] [<ffffffff82e6b129>] ? _raw_spin_unlock_irqrestore+0x9/0x10
120+
[ 25.362445] [<ffffffff8203c1d6>] __device_attach+0x1c6/0x2a0
121+
[ 25.362971] [<ffffffff8203c010>] ? device_bind_driver+0x30/0x30
122+
[ 25.363524] [<ffffffff819fe492>] ? kobject_uevent_env+0x202/0xa50
123+
[ 25.364090] [<ffffffff8203cebe>] device_initial_probe+0xe/0x10
124+
[ 25.364632] [<ffffffff8203a299>] bus_probe_device+0x199/0x240
125+
[ 25.365166] [<ffffffff8203447c>] device_add+0x94c/0x1340
126+
[ 25.365670] [<ffffffff82033b30>] ? device_private_init+0x180/0x180
127+
[ 25.366237] [<ffffffff8204ee24>] ? wakeup_sysfs_add+0x14/0x20
128+
[ 25.366757] [<ffffffff82061b20>] ? device_set_wakeup_capable+0xc0/0x160
129+
[ 25.367354] [<ffffffff82310d3c>] usb_set_configuration+0xaec/0x1540
130+
[ 25.367919] [<ffffffff8232e516>] generic_probe+0x56/0xb0
131+
[ 25.368402] [<ffffffff8231762a>] usb_probe_device+0x8a/0xc0
132+
[ 25.368908] [<ffffffff8203c79e>] driver_probe_device+0x4be/0x800
133+
[ 25.369451] [<ffffffff8203cda6>] __device_attach_driver+0x176/0x220
134+
[ 25.370019] [<ffffffff8203cc30>] ? __driver_attach+0x150/0x150
135+
[ 25.370548] [<ffffffff82037682>] bus_for_each_drv+0x112/0x1b0
136+
[ 25.371068] [<ffffffff82037570>] ? bus_rescan_devices+0x20/0x20
137+
[ 25.371604] [<ffffffff82e6b129>] ? _raw_spin_unlock_irqrestore+0x9/0x10
138+
[ 25.372199] [<ffffffff8203c1d6>] __device_attach+0x1c6/0x2a0
139+
[ 25.372708] [<ffffffff8203c010>] ? device_bind_driver+0x30/0x30
140+
[ 25.373248] [<ffffffff819fe492>] ? kobject_uevent_env+0x202/0xa50
141+
[ 25.373804] [<ffffffff8203cebe>] device_initial_probe+0xe/0x10
142+
[ 25.374320] [<ffffffff8203a299>] bus_probe_device+0x199/0x240
143+
[ 25.374839] [<ffffffff8203447c>] device_add+0x94c/0x1340
144+
[ 25.375323] [<ffffffff82033b30>] ? device_private_init+0x180/0x180
145+
[ 25.375883] [<ffffffff822f41a1>] usb_new_device+0x701/0xfa0
146+
[ 25.376386] [<ffffffff822f8580>] hub_event+0x1b70/0x2d00
147+
[ 25.376870] [<ffffffff822f6a10>] ? hub_port_debounce+0x1b0/0x1b0
148+
[ 25.377413] [<ffffffff82050101>] ? dev_pm_get_subsys_data+0x71/0x1c0
149+
[ 25.377994] [<ffffffff8100a4fc>] ? __switch_to+0x7ac/0xe40
150+
[ 25.378492] [<ffffffff82e6b129>] ? _raw_spin_unlock_irqrestore+0x9/0x10
151+
[ 25.379068] [<ffffffff820575cd>] ? __pm_runtime_suspend+0x8d/0xb0
152+
[ 25.379620] [<ffffffff8113622f>] ? pwq_dec_nr_in_flight+0x11f/0x270
153+
[ 25.380187] [<ffffffff822f682d>] ? usb_remote_wakeup+0x4d/0x80
154+
[ 25.380720] [<ffffffff81137375>] process_one_work+0x585/0x1200
155+
[ 25.381249] [<ffffffff811380c7>] worker_thread+0xd7/0x1200
156+
[ 25.381742] [<ffffffff82e608b5>] ? __schedule+0x935/0x1d60
157+
[ 25.382242] [<ffffffff81137ff0>] ? process_one_work+0x1200/0x1200
158+
[ 25.382791] [<ffffffff81148ba0>] kthread+0x1c0/0x260
159+
[ 25.383242] [<ffffffff811489e0>] ? kthread_worker_fn+0x580/0x580
160+
[ 25.383784] [<ffffffff8100a4fc>] ? __switch_to+0x7ac/0xe40
161+
[ 25.384280] [<ffffffff811489e0>] ? kthread_worker_fn+0x580/0x580
162+
[ 25.384824] [<ffffffff82e6bb4f>] ret_from_fork+0x3f/0x70
163+
[ 25.385304] [<ffffffff811489e0>] ? kthread_worker_fn+0x580/0x580
164+
[ 25.385846] Memory state around the buggy address:
165+
[ 25.386271] ffff88006a8c5c80: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb
166+
[ 25.386906] ffff88006a8c5d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
167+
[ 25.387548] >ffff88006a8c5d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
168+
[ 25.388184] ^
169+
[ 25.388565] ffff88006a8c5e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
170+
[ 25.389202] ffff88006a8c5e80: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc
171+
[ 25.389844] ==================================================================

0 commit comments

Comments
(0)

AltStyle によって変換されたページ (->オリジナル) /