Note: This is a beta release of Red Hat Bugzilla 5.0. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Also email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback here.

Bug 229884

Summary: CVE-2007-0005 Buffer Overflow in Omnikey CardMan 4040 cmx driver
Product: Red Hat Enterprise Linux 5 Reporter: Linda Wang <lwang>
Component: kernelAssignee: Don Howard <dhoward>
Status: CLOSED ERRATA QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 5.0CC: dzickus, security-response-team
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard: impact=moderate,source=vendorsec,reported=20070206,embargo=20070306,public=20070306
Fixed In Version: RHSA-2007-0099 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2007-03-14 15:05:01 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:

Comment 7 Marcel Holtmann 2007-03-02 15:56:48 UTC
From Daniel Roethlisberger wrote

While using the Linux drivers for the CM4040 as a reference for writing a cmx
FreeBSD driver I found two buffer overflows in the Linux drivers, one in the
write() and one in the read() handler.  

When calling write() with a buffer larger than 512 bytes, the driver's write
buffer overflows, allowing to overwrite the EIP and execute arbitrary code with
kernel privileges.  

In read(), we have a similar problem, but coming from the device. A malicous or
buggy device sending more than 512 bytes can overflow of the driver's read
buffer, with the same effects as above.

The write() vulnerability can only be exploited by a user with direct or
indirect write access to the cmx device special file. Normally, this is limited
to root, so this is not an issue. However, it might be possible for unprivileged
users to cause large writes indirectly via userland daemons such as those
provided by pcsc-lite or openct. Since "normal" APDU payloads are smaller than
512 bytes, this may not be an issue, but I haven't looked into that.
Furthermore, a system can be set up to allow access to the device for a special
user or group, in order to increase security by running the userland drivers
without root privileges. In such a setup, users with access to the device can
elevate privileges or cause DoS.

The problem code in cm4040_cs.c:cm4040_write() is on line 358 (current version
in Linus' git tree), when calling copy_from_user() with user supplied
bytes_to_write, which can be larger than 512 bytes. Because it does not seem to
make sense to write partial messages to this card reader, I think it is best to
return an appropriate error on write()'s larger than the write buffer. This is
what I do in the FreeBSD driver.

The problem code in cm4040_cs.c:cm4040_read() is around line 271 where
bytes_to_read is read from the card reader, and subsequently, min(count,
bytes_to_read + 5) bytes are read from the reader. min(count, bytes_to_read + 5)
can however be larger than the read buffer, which would cause an overflow.

Comment 9 Marcel Holtmann 2007-03-06 17:43:07 UTC
The embargo ended on 6th of March.

Comment 12 Red Hat Bugzilla 2007-03-14 15:05:01 UTC
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.