CVE-2016-2547 & CVE-2018-20961 #212

jm8084 · 2023-11-08T04:22:56Z

First draft... Need further digging

CVE: 2016-2547, 2018-20961

bjk5739

Overall good job. Just try to rewrite short notes to be more complete and elaborate on technical terminology- both of these will show confidence in your research

bjk5739 · 2023-11-09T19:36:35Z

cves/kernel/CVE-2016-2547.yml

-description:
+description: The Advanced Linux Sound Architecture (ALSA) is a framework in the linux kernal that provides 
+  an interface for sound cards devices. The framework used a resource locking approach that did not 
+  consider slave timer instances. The instacne could still be accessed, creating  race condition 


Misspelled instance here & creating a race condition

You describe the ALSA subsystem well, but should also go into detail for terms like "slave timer" and "race condition" for those who may not be familiar with them.

bjk5739 · 2023-11-09T19:41:02Z

cves/kernel/CVE-2016-2547.yml

@@ -227,7 +232,7 @@ subsystem:
    e.g.
        name: ["subsystemA", "subsystemB"] # ok
        name: subsystemA # also ok
-  name:
+  name: sound


Instead of sound, you likely want to put drivers as the subsystem or ASLA, as you mentioned before. Sound is made up of ASLA drivers and utilities, and is not technically a subsystem.

Looking at the repository, I think it's fine actually. Sound is certainly a subsystem, and it appears that no other subsystems were involved.

bjk5739 · 2023-11-09T19:41:57Z

cves/kernel/CVE-2016-2547.yml

-  answer:
-  note:
+  answer: false
+  note: only systems using the Advanced Linux Sound Architecture (ALSA) 


This reads funny. I would recommend rephrasing

Yeah I'm unsure how this relates to i18n. Definitely review, but since it is a general sound framework, I doubt it has any notable relation to i18n.

bjk5739 · 2023-11-09T19:42:52Z

cves/kernel/CVE-2016-2547.yml

-  answer:
-  note:
+  answer: true
+  note: check if all instances are locked


In general, notes like this should be more complete to add confidence in your work

bjk5739 · 2023-11-09T19:43:24Z

cves/kernel/CVE-2016-2547.yml

@@ -456,7 +461,7 @@ mistakes:

    Write a thoughtful entry here that people in the software engineering
    industry would find interesting.
-  answer:
+  answer: This is a coding lapse. The developer forgot to lock all instances 


I would elaborate on locking and instances and what role they play

bjk5739 · 2023-11-09T19:44:01Z

cves/kernel/CVE-2016-2547.yml

@@ -482,4 +487,4 @@ nickname_instructions: |
  If the report mentions a nickname, use that.
  Must be under 30 characters. Optional.
 nickname:
-CVSS:
+CVSS: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H


Add to upvotes (since not changed in commit): I give this a 2

bjk5739 · 2023-11-09T19:45:09Z

cves/kernel/CVE-2018-20961.yml

@@ -106,7 +108,7 @@ vcc_instructions: |
  Place any notes you would like to make in the notes field.
 vccs:
 - commit: ad0d1a058eac46503edbc510d1ce44c5df8e0c91
-  note: Discovered automatically by archeogit.
+  note: Patch meant to fix memory leak when system fails
 - commit: '079fe5a6da616891cca1a26e803e1df2a87e9ae5'
  note: Discovered automatically by archeogit.


Did you manually confirm this? Be sure to mention that if so!

bjk5739 · 2023-11-09T19:46:04Z

cves/kernel/CVE-2018-20961.yml

-  automated:
-  contest:
-  developer:
+  answer: Greg Kroah-Hartman from linux foundations 


How was it discovered? If that's not mentioned, bring that up.

bjk5739 · 2023-11-09T19:46:36Z

cves/kernel/CVE-2018-20961.yml

-  answer:
-  note:
+  answer: true
+  note: double-free can cause arbitrary code exe.


Don't shorten execution here

bjk5739 · 2023-11-09T19:47:23Z

cves/kernel/CVE-2018-20961.yml

@@ -454,7 +456,7 @@ mistakes:

    Write a thoughtful entry here that people in the software engineering
    industry would find interesting.
-  answer:
+  answer: This is a coding lapse. The developer forgot to check if resource was already free
 CWE_instructions: |
  Please go to http://cwe.mitre.org and find the most specific, appropriate CWE
  entry that describes your vulnerability. We recommend going to


Add to Upvotes (since not changed in commit): I give this a 2

I give this 2 upvotes as well

I give this 3 upvotes

AcrylicRobin · 2023-11-13T16:20:35Z

cves/kernel/CVE-2018-20961.yml

-  fix:
-  fix_answer:
+  code: false
+  code_answer: no unit tests found in commits


In general, check your capitalization for your notes.

zmontgomery

Shows good understanding of the vulnerability but lacks some details.

EDIT: I give 3 upvotes

zmontgomery · 2023-11-19T19:05:28Z

cves/kernel/CVE-2016-2547.yml

 reported_instructions: |
  What date was the vulnerability reported to the security team? Look at the
  security bulletins and bug reports. It is not necessarily the same day that
  the CVE was created.  Leave blank if no date is given.

  Please enter your date in YYYY-MM-DD format.
-reported_date:
+reported_date: '2016-02-24'


Unsure what the exact "reported" date might be, but I found bug reports as early as January 13th from the NVD references: https://lore.kernel.org/all/CACT4Y+ZrVvE3dgcYHRdHDG0X316VgC-=pr2U-233vVn_QbHZHw@mail.gmail.com/T/#u

zmontgomery · 2023-11-27T15:49:35Z

cves/kernel/CVE-2016-2547.yml

-description:
+description: The Advanced Linux Sound Architecture (ALSA) is a framework in the linux kernal that provides 
+  an interface for sound cards devices. The framework used a resource locking approach that did not 
+  consider slave timer instances. The instacne could still be accessed, creating  race condition 


You describe the ALSA subsystem well, but should also go into detail for terms like "slave timer" and "race condition" for those who may not be familiar with them.

zmontgomery · 2023-11-27T15:56:14Z

cves/kernel/CVE-2016-2547.yml

-  developer:
+  answer: Dmitry Vyukov, Google developer, discovered that the Advanced Linux Sound Architecture (ALSA)
+    framework's handling of high resolution timers did not properly manage its
+    data structures 2016-01-15


At the bottom of the fix commit, a system call fuzzer from Google (known as syzkaller) is referenced. It may be worth mentioning as it likely played a role in detecting this bug.

"Dmitry Vyukov reported a series of kernel bugs in ALSA core that have been
triggered by syzkaller fuzzer" - https://www.openwall.com/lists/oss-security/2016/01/19/1

zmontgomery · 2023-11-27T17:44:35Z

cves/kernel/CVE-2016-2547.yml

@@ -175,8 +180,8 @@ autodiscoverable:

    The answer field should be boolean. In answer_note, please explain
    why you come to that conclusion.
-  note:
-  answer:
+  note: fuzzer, use-after-free


This may need some expanding. Maybe give sentences, along with any related thoughts.

zmontgomery · 2023-11-27T17:49:39Z

cves/kernel/CVE-2016-2547.yml

@@ -227,7 +232,7 @@ subsystem:
    e.g.
        name: ["subsystemA", "subsystemB"] # ok
        name: subsystemA # also ok
-  name:
+  name: sound


Looking at the repository, I think it's fine actually. Sound is certainly a subsystem, and it appears that no other subsystems were involved.

zmontgomery · 2023-11-27T18:04:00Z

cves/kernel/CVE-2016-2547.yml

-  answer:
-  note:
+  answer: true
+  note: access instance that should be locked for privileged resources 


It's hard to say, but I would disagree here. Privilege doesn't seem to be the issue, instead more careful management of that resource in a multi-threaded environment.

zmontgomery · 2023-11-28T00:31:21Z

cves/kernel/CVE-2018-20961.yml

 reported_instructions: |
  What date was the vulnerability reported to the security team? Look at the
  security bulletins and bug reports. It is not necessarily the same day that
  the CVE was created.  Leave blank if no date is given.

  Please enter your date in YYYY-MM-DD format.
-reported_date:
+reported_date: '2019-08-07'


It seems you didn't look very hard

zmontgomery · 2023-11-28T00:35:08Z

cves/kernel/CVE-2018-20961.yml

-description:
+description: Some USB gadgets have multiple 'modes' devices that can switch between modes 
+  and possibly cause a double-free flaw. Subsequently the USB gadget Midi driver 
+  in the Linux kernel created a double-free when handling certain errors. 


Good, but if nothing else maybe explain what a double free means/why it crashes and how it crashes

zmontgomery · 2023-11-28T00:37:25Z

cves/kernel/CVE-2018-20961.yml

@@ -173,8 +175,8 @@ autodiscoverable:

    The answer field should be boolean. In answer_note, please explain
    why you come to that conclusion.
-  note:
-  answer:
+  note: no tools/tests mentioned in commits


It mentions MOXCAFE. I see little info on it, but it should be mentioned as it is in the fix commit

zmontgomery · 2023-11-28T00:40:38Z

cves/kernel/CVE-2018-20961.yml

-  answer:
-  note:
+  answer: true
+  note: usb instance freed when process failed


Maybe a few more details for understanding.

jm8084 added 6 commits November 7, 2023 23:10

0

2945634

CVE-2016-2547, CVE-2018-20961

b72b269

Merge branch 'dev' of https://github.com/jm8084/jm8084vulns into dev

9f4c526

CVE: 2016-2547, 2018-20961

CVE: 2016-2547, 2018-20961

8d97b46

CVE: 2016-2547 & 2018-20961

c776fdb

CVE: 2016-2547, 2018-20961

43888ba

bjk5739 reviewed Nov 9, 2023

View reviewed changes

andymeneely added the cohort R label Nov 10, 2023

AcrylicRobin reviewed Nov 13, 2023

View reviewed changes

zmontgomery reviewed Nov 28, 2023

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CVE-2016-2547 & CVE-2018-20961 #212

CVE-2016-2547 & CVE-2018-20961 #212

jm8084 commented Nov 8, 2023

bjk5739 left a comment

bjk5739 Nov 9, 2023

zmontgomery Nov 27, 2023

bjk5739 Nov 9, 2023

zmontgomery Nov 27, 2023

bjk5739 Nov 9, 2023

zmontgomery Nov 27, 2023

bjk5739 Nov 9, 2023

bjk5739 Nov 9, 2023

bjk5739 Nov 9, 2023

bjk5739 Nov 9, 2023

bjk5739 Nov 9, 2023

bjk5739 Nov 9, 2023

bjk5739 Nov 9, 2023

AcrylicRobin Nov 13, 2023

zmontgomery Nov 28, 2023

AcrylicRobin Nov 13, 2023

zmontgomery left a comment •

edited

Loading

zmontgomery Nov 19, 2023

zmontgomery Nov 27, 2023

zmontgomery Nov 27, 2023

zmontgomery Nov 27, 2023

zmontgomery Nov 27, 2023

zmontgomery Nov 27, 2023

zmontgomery Nov 27, 2023

zmontgomery Nov 28, 2023

zmontgomery Nov 28, 2023

zmontgomery Nov 28, 2023

zmontgomery Nov 28, 2023

CVE-2016-2547 & CVE-2018-20961 #212

Are you sure you want to change the base?

CVE-2016-2547 & CVE-2018-20961 #212

Conversation

jm8084 commented Nov 8, 2023

bjk5739 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zmontgomery left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

zmontgomery left a comment •

edited

Loading