-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 To all, Usage of a floppy device can allow users to get root access in the Linux Kernel. Supposedly this has been posted to the Linux distros already, but I'm posting it here just in case. Regards, Mark

Hi,

As this was posted to linux-distros, and was supposed to be made public earlier this week, but so far wasn't published on oss-sec ...

Reported by Matthew Daley to security@kernel.org.

There apparently exists a proof of concept root exploit, that allows local users with access to a floppy device to execute code in the linux kernel.

(I think this needs a floppy driver to actually allow access to a floppy device. My machine only says "floppy0: no floppy controllers found" today.)

Linux Kernel Mainline commits:

2145e15e0557a01b9195d1c7199a1b92cb9be81f Author: Matthew Daley <mattd@bugfuzz.com> Date: Mon Apr 28 19:05:21 2014 +1200

floppy: don't write kernel-only members to FDRAWCMD ioctl output

Do not leak kernel-only floppy_raw_cmd structure members to userspace. This includes the linked-list pointer and the pointer to the allocated DMA space.

Signed-off-by: Matthew Daley <mattd@bugfuzz.com> References: CVE-2014-1738 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit ef87dbe7614341c2e7bfe8d32fcb7028cc97442c Author: Matthew Daley <mattd@bugfuzz.com> Date: Mon Apr 28 19:05:20 2014 +1200

floppy: ignore kernel-only members in FDRAWCMD ioctl input

Always clear out these floppy_raw_cmd struct members after copying the entire structure from userspace so that the in-kernel version is always valid and never left in an interdeterminate state.

Signed-off-by: Matthew Daley <mattd@bugfuzz.com> References: CVE-2014-1737 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Ciao, Marcus

-----BEGIN PGP SIGNATURE----- Version: GnuPG v2.0.22 (GNU/Linux) iF4EAREIAAYFAlNsgSsACgkQZ/Z80n6+J/ZEugD+PQHpcvqb9vKhkZRpfBIEkC9c zJOaYQZ087dTZXZALIUBAIkxSbWuz+8vOowk/5OfcsySi+wu7afqwvuXDjKn78qO =UxRa -----END PGP SIGNATURE-----