Beck Anderson CVE-2013-2058 & CVE-2019-20636 Request #164

Skeeter2600 · 2023-10-30T17:34:55Z

No description provided.

…there was the issue

tmb7852 · 2023-11-07T13:55:04Z

cves/kernel/CVE-2013-2058.yml

-  hexademical string/
-
-  Place any notes you would like to make in the notes field.
+bugs: [959210]


According to bugzilla, this also depends on 959234 and 959235

tmb7852 · 2023-11-07T13:57:51Z

cves/kernel/CVE-2013-2058.yml

-  fix_answer:
+  code: false
+  code_answer: "I find it difficult to believe that unit tests were involved with the discovery
+    due to how long it took to find the bug and the method of testing. The vulnerability was


I would try to stay away from talking in the first person, maybe be a little more firm in your stance as well.

tmb7852 · 2023-11-07T13:59:07Z

cves/kernel/CVE-2013-2058.yml

+  answer: "There isn't any specific record of how this vulnerability was discovered. The
+    closest record is a message chain on openwall between an individual at Redhat asking to create
+    an entry for this vulnerability in response to the bug report on bugzilla.redhat.com. This test
+    was most likely found by a developer at for freescale (now NXP). They were the ones to make the


I don't think "at for freescale" is intended. Also Freescale should be capitalized.

tmb7852 · 2023-11-07T13:59:42Z

cves/kernel/CVE-2013-2058.yml

+    issue and the fix."
+  automated: false
+  contest: false
+  developer: false


You said it was likely found by a dev but then marked this false.

tmb7852 · 2023-11-07T14:02:25Z

cves/kernel/CVE-2013-2058.yml

+    using a tool. It would require an external device to connect to the port 
+    and provide data for testing, as well as a program running on the hardware 
+    being tested. The test device would provide different types of data of different
+    sizes and the hardware would report the outcome of the transfer."


I would question the plausibility of this. While I agree it would be possible to automate, I would argue that the specific steps to test are very specific and cater to this vulnerability. This would almost require prior knowledge of the vulnerability to create a test if it exists.

tmb7852 · 2023-11-07T14:04:33Z

cves/kernel/CVE-2013-2058.yml

-  note:
+  discussed_as_security: false
+  any_discussion: false
+  note: "no record of discussions"


You previously described a discussion which occurred with NXP folks.

there wasn't really a discussion about the issue, just a developer at NXP finding it and recommending a fix, which they took. Thank you though!

tmb7852 · 2023-11-07T14:17:45Z

cves/kernel/CVE-2013-2058.yml

-  upvotes to each vulnerability you see. Your peers will tell you how
-  interesting they think this vulnerability is, and you'll add that to the
-  upvotes score on your branch.
+  note: "File created with vulnerability in this commit"
 upvotes:


I am going to give this a 4 because I like vulnerabilities that include hardware.

tmb7852 · 2023-11-07T14:18:12Z

cves/kernel/CVE-2019-20636.yml

 upvotes_instructions: |
  For the first round, ignore this upvotes number.

  For the second round of reviewing, you will be giving a certain amount of
  upvotes to each vulnerability you see. Your peers will tell you how
  interesting they think this vulnerability is, and you'll add that to the
  upvotes score on your branch.
-upvotes:
+upvotes: 6


I will give this a 2

I'd also give this a 2

tmb7852 · 2023-11-07T14:23:14Z

cves/kernel/CVE-2019-20636.yml

-  note:
+  answer: false
+  note: "In the fix for the bug, there was only Dmitry Torokhov in the sign off for
+    it in response to the message received alerting about the vulnerability. It


This sentence feels a little weird to read. Not sure the best way to rephrase though.

tmb7852 · 2023-11-07T14:24:18Z

cves/kernel/CVE-2019-20636.yml

+  answer: true
+  note: "Issue was a result of a modification/clearing of the data before
+    a couple checks. By moving setting and clearing inside of an already existent
+    coule of checks, it prevents the issue if the input would cause problems."


couple, not coule.

arb5076 · 2023-11-08T15:30:12Z

cves/kernel/CVE-2013-2058.yml

+    an entry for this vulnerability in response to the bug report on bugzilla.redhat.com. This test
+    was most likely found by a developer at Freescale (now NXP). They were the ones to make the
+    suggestion for the fix which was later signed off on. It is unclear what led them to finding the
+    issue and the fix."


Maybe include the full link here?

arb5076 · 2023-11-08T15:33:19Z

cves/kernel/CVE-2013-2058.yml

+  answer: true
+  note: "This fix was suggested by an employee of freescale (Peter Chen) and then signed off by another member
+      of freespace (Fabio Estevam), as well as Greg Kroah-Hartman of the linux foundation. This information is in
+      the commit message of the fix."


I would just add the link to the discussion here, but it was good to add the names of the developers here.

arb5076 · 2023-11-08T15:34:41Z

cves/kernel/CVE-2013-2058.yml

-  note:
+  answer: false
+  note: \
+    The check could happen at any time, but needs to happen. 


Not to be nit picky, but ideally it happens before it's sent across the network :)

arb5076 · 2023-11-08T15:35:36Z

cves/kernel/CVE-2013-2058.yml

+      was expected and being more complex than expected. The data should
+      be validated when received to ensure it matches what is expected and
+      accepted. If it isn't, it should be talked about if that data should
+      be understood and processed or be blocked."


This was difficult to read and understand. I would rephrase this.

arb5076 · 2023-11-08T15:37:06Z

cves/kernel/CVE-2019-20636.yml

-description:
+description: "In the Linux kernel before version 5.4.12, the file drivers/input/input.c 
+  can cause out-of-bounds issues via a crafted keycode table. This can result in denial of service
+  (crash or memory corruption) or privilege escalation."


I'd explain what a keycode table is here.

arb5076 · 2023-11-08T15:39:35Z

cves/kernel/CVE-2019-20636.yml

-  developer:
+  answer: "The individual who messaged about the vulnerability was Dmitry Torokhov,
+    an individual who was a senior software engineer at Google at the time of the
+    discovery."


I'd argue this is more about who discovered the vulnerability, not how it was discovered. I could be misinterpreting it, though.

bea1935 added 7 commits October 30, 2023 13:33

initial

d6e5cb0

2013-2058 almost complete, outlined and understand 2019-20636

60ad630

completed analysis of the vulnerabilities

50d395c

fix to yml parsing issues hopefully

5e824a1

check 2?

6fb52c8

attempt again. checking if formatting for "missing checks" that were …

fea87dc

…there was the issue

try try again

25b8901

andymeneely added the cohort I label Nov 2, 2023

tmb7852 reviewed Nov 7, 2023

View reviewed changes

bea1935 added 2 commits November 7, 2023 09:56

updated based off of comments from tmb7852

d49a9e2

updated based off of comments from tmb7852

fcb0e34

arb5076 reviewed Nov 8, 2023

View reviewed changes

updated based off of comments from arb5076

9f68f1e

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Beck Anderson CVE-2013-2058 & CVE-2019-20636 Request #164

Beck Anderson CVE-2013-2058 & CVE-2019-20636 Request #164

Skeeter2600 commented Oct 30, 2023

tmb7852 Nov 7, 2023

tmb7852 Nov 7, 2023

tmb7852 Nov 7, 2023

tmb7852 Nov 7, 2023

tmb7852 Nov 7, 2023

tmb7852 Nov 7, 2023

Skeeter2600 Nov 7, 2023 •

edited

Loading

tmb7852 Nov 7, 2023

tmb7852 Nov 7, 2023

arb5076 Nov 8, 2023

tmb7852 Nov 7, 2023

tmb7852 Nov 7, 2023

arb5076 Nov 8, 2023

arb5076 Nov 8, 2023

arb5076 Nov 8, 2023

arb5076 Nov 8, 2023

arb5076 Nov 8, 2023

arb5076 Nov 8, 2023

Beck Anderson CVE-2013-2058 & CVE-2019-20636 Request #164

Are you sure you want to change the base?

Beck Anderson CVE-2013-2058 & CVE-2019-20636 Request #164

Conversation

Skeeter2600 commented Oct 30, 2023

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Skeeter2600 Nov 7, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Skeeter2600 Nov 7, 2023 •

edited

Loading