CVE-2015-5366 and CVE-2016-2184 #213

Borna5356 · 2023-11-08T15:16:30Z

CVE-2015-5366 : This is a vulnerability that affects the UDP stack and can cause a Denial of Service.

CVE-2016-2184: This is a vulnerability that is impacts the USB audio connection causing a null pointer error resulting in a Denial of Service.

724jth · 2023-11-09T00:50:59Z

cves/kernel/CVE-2016-2184.yml

@@ -56,6 +56,10 @@ description_instructions: |
  Your target audience is people just like you before you took any course in
  security
 description:
+The create_fixed_stream_quirk funcrtion in sound/usb/quirks.c in the snd-usb-audio 


I think you meant function not funcrtion.

jym2584

CVE-2016-2184: 2 upvotes. I think it's interesting to learn more about hardware vulnerabilities that affect the linux kernel
CVE-2015-5366: 1 upvote. Interesting read for passing in the incorrect checksum. I remember encountering a similar issue before during my internship which ran incorrect file integrity checks

jym2584 · 2023-11-10T04:10:36Z

cves/kernel/CVE-2015-5366.yml

@@ -225,7 +238,7 @@ subsystem:
    e.g.
        name: ["subsystemA", "subsystemB"] # ok
        name: subsystemA # also ok
-  name:
+  name: This bug affect the net subsystem


I would replace this with ["net", "subsystem"] to adhere to the required syntax

jym2584 · 2023-11-10T04:11:03Z

cves/kernel/CVE-2015-5366.yml

  note:
+  This is because the on the commit message fixing the bug it was signed off bu both Eric Dumazet and 


Typo (by)
I think it would also be good to provide a source

jym2584 · 2023-11-10T14:08:47Z

cves/kernel/CVE-2015-5366.yml

@@ -55,7 +55,10 @@ description_instructions: |

  Your target audience is people just like you before you took any course in
  security
-description:
+description: 
+The udp_revmsg and udpv6_recvmsg functions in the linuz kernel that provide 


I think the description would be better clarified since the issues described in the git diff and patch notes could lead to a denial of service by causing an EPOLLET epoll application read outage when there's an incorrect checksum in a UDP packet.

jym2584 · 2023-11-10T14:09:25Z

cves/kernel/CVE-2015-5366.yml

-  developer:
+  answer: 
+  The vulnerability was found in a twitter message where the security team was
+  contacted to create the CVE,


Are you able to link the twitter message?

jym2584 · 2023-11-10T14:13:05Z

cves/kernel/CVE-2015-5366.yml

  note:
+  This vulnerability directly affected UDP connection as it was interuptin the 


interrupting

jym2584 · 2023-11-10T14:13:31Z

cves/kernel/CVE-2015-5366.yml

@@ -312,8 +338,11 @@ discussion:
    Put any links to disagreements you found in the notes section, or any other
    comment you want to make.
  discussed_as_security:
+  The discussion is talking about the security risk of the invalid checksum and
+  what threath it is to the system


jym2584 · 2023-11-10T14:15:44Z

cves/kernel/CVE-2016-2184.yml

-  developer:
-autodiscoverable:
+  answer: 
+  The bug was found using the USB-fuzzing frramework from SergeJ Shumilo. This


jym2584 · 2023-11-10T14:16:06Z

cves/kernel/CVE-2016-2184.yml

@@ -223,7 +240,7 @@ subsystem:
    e.g.
        name: ["subsystemA", "subsystemB"] # ok
        name: subsystemA # also ok
-  name:
+  name: The subsystem that the bug was apart of was the sound subsystem


This should just be sound

I second this.

andymeneely

Looks like you had the same mistake 28x lol. Should be an easy fix to get the yaml parsing. If you've cloned locally, I recommend using the YAML extension for VS Code to find your syntax errors. Well done, though!

andymeneely · 2023-11-11T14:10:44Z

cves/kernel/CVE-2015-5366.yml

-description:
+description: 
+The udp_revmsg and udpv6_recvmsg functions in the linuz kernel that provide 
+inappropriate EAGAIN return values. This allows attackers to perform a DOS via


Make sure you indent this text - that's probably why the yaml is broken

andymeneely · 2023-11-11T14:11:08Z

cves/kernel/CVE-2015-5366.yml

+  code_answer: 
+  Returns -EAGAIN to the application even if recieve queue is not empty. 
+  This breaks the application using edge trigger epoll()


Suggested change

code_answer:

Returns -EAGAIN to the application even if recieve queue is not empty.

This breaks the application using edge trigger epoll()

code_answer: |

Returns -EAGAIN to the application even if recieve queue is not empty.

This breaks the application using edge trigger epoll()

andymeneely · 2023-11-11T14:11:27Z

cves/kernel/CVE-2015-5366.yml

+  answer: 
+  The vulnerability was found in a twitter message where the security team was
+  contacted to create the CVE,


Suggested change

answer:

The vulnerability was found in a twitter message where the security team was

contacted to create the CVE,

answer: |

The vulnerability was found in a twitter message where the security team was

contacted to create the CVE,

andymeneely · 2023-11-11T14:11:54Z

cves/kernel/CVE-2015-5366.yml

+  note: 
+  The reason why this bug can be discovered automatically is because the
+  bug causes a DOS attack because it causes an infinite loop making it so
+  that users can't get acces to the data. This can be tested automatically
+  by tesitng edge cases for return values.


Suggested change

note:

The reason why this bug can be discovered automatically is because the

bug causes a DOS attack because it causes an infinite loop making it so

that users can't get acces to the data. This can be tested automatically

by tesitng edge cases for return values.

note: |

The reason why this bug can be discovered automatically is because the

bug causes a DOS attack because it causes an infinite loop making it so

that users can't get acces to the data. This can be tested automatically

by tesitng edge cases for return values.

andymeneely · 2023-11-11T14:12:15Z

cves/kernel/CVE-2015-5366.yml

+  note: 
+  there was no violation of a specification as the bug appeared from not 
+  properly checking and validating the result before returning it. 


Suggested change

note:

there was no violation of a specification as the bug appeared from not

properly checking and validating the result before returning it.

note: |

there was no violation of a specification as the bug appeared from not

properly checking and validating the result before returning it.

andymeneely · 2023-11-11T14:17:44Z

cves/kernel/CVE-2016-2184.yml

  note:
+  This is because the user might not be able to connect to the application
+  via USB and be able to use the audio.


Suggested change

note:

This is because the user might not be able to connect to the application

via USB and be able to use the audio.

note: |

This is because the user might not be able to connect to the application

via USB and be able to use the audio.

andymeneely · 2023-11-11T14:17:56Z

cves/kernel/CVE-2016-2184.yml

  note:
+  This is because the bug impacts the usb connection which transfers data using packets


Suggested change

note:

This is because the bug impacts the usb connection which transfers data using packets

note: |

This is because the bug impacts the usb connection which transfers data using packets

andymeneely · 2023-11-11T14:18:11Z

cves/kernel/CVE-2016-2184.yml

+  note: 
+  The only fix that was needed was to make sure that there were more than
+  one endpoints.


Suggested change

note:

The only fix that was needed was to make sure that there were more than

one endpoints.

note: |

The only fix that was needed was to make sure that there were more than

one endpoints.

andymeneely · 2023-11-11T14:18:33Z

cves/kernel/CVE-2016-2184.yml

+    note: The reason the error was happening was because there was nothing checking
+    the endpoint value


Suggested change

note: The reason the error was happening was because there was nothing checking

the endpoint value

note: |

The reason the error was happening was because there was nothing checking the

endpoint value

andymeneely · 2023-11-11T14:18:44Z

cves/kernel/CVE-2016-2184.yml

  answer:
+  The main mistake that was made in this application was not sanitizng
+  the inputs to check and see if there was moe than one endpoint connected
+  via USB


Suggested change

answer:

The main mistake that was made in this application was not sanitizng

the inputs to check and see if there was moe than one endpoint connected

via USB

answer: |

The main mistake that was made in this application was not sanitizng

the inputs to check and see if there was moe than one endpoint connected

via USB

nolan-white · 2023-11-12T01:50:40Z

cves/kernel/CVE-2016-2184.yml

+  The create_fixed_stream_quirk function in sound/usb/quirks.c in the snd-usb-audio 
+  driver in the Linux kernel before 4.5.1 allows physicaaly prximate attackers to 
+  cause a DOS (NULL pointer dereference or double free and system crash) via a
+  crafted endpoints value in a USB device descriptor


This is just the CVE description. The instructions say to remove references to versions, specific filenames, and other jargon, and explain it in your own words, so I would suggest rewriting this section.

Also if I am interpreting this correctly, is the idea that you could craft a USB sound device that consistently crashes the computer when you plug it in? If so that's a pretty neat vulnerability. Leans into the side-channel attacks we talked about in class.

nolan-white · 2023-11-12T01:53:56Z

cves/kernel/CVE-2016-2184.yml

@@ -75,7 +79,7 @@ bugs_instructions: |
    * Mentioned in mailing list discussions
    * References from NVD entry
    * Various other places
-bugs: []
+bugs: [971125]


This didn't work when I tried to access it via https://bugzilla.kernel.org/show_bug.cgi?id=971125. Was this perhaps on Red Hat's or another distribution's bugzilla.

nolan-white · 2023-11-12T02:00:53Z

cves/kernel/CVE-2016-2184.yml

+    create_fixed_stream_quirk() may cause a NULL-pointer dereference by 
+    accessing the non-existing endpoint when a USB device with a malformed USB
+    descriptor is used. This patch avoids it simply by adding a sanity check of
+    bNumEndpoints before the accesses.


This probably shouldn't reference specific functions and variable names, but instead describe them at a higher-level for the reader.

nolan-white · 2023-11-12T02:04:24Z

cves/kernel/CVE-2016-2184.yml

  fix:
  fix_answer:
+    The fix was adding a check to make sure that the number of endpoints was
+    greater than 1


fix is missing its Boolean value. Also the notes in this section should describe if unit tests existed for this code before and after the fix, not the fix itself.

nolan-white · 2023-11-12T02:08:18Z

cves/kernel/CVE-2016-2184.yml

-autodiscoverable:
+  answer: 
+    The bug was found using the USB-fuzzing frramework from SergeJ Shumilo. This
+    found out that the crash was caused by a zero value for bNumEndpoints.


Typo in "frramework". Also I would suggest replacing the variable name with a high-level description of what that variable represents.

nolan-white · 2023-11-12T02:11:26Z

cves/kernel/CVE-2016-2184.yml

@@ -189,7 +205,9 @@ specification:
    The answer field should be boolean. In answer_note, please explain
    why you come to that conclusion.
  note:
-  answer:
+    This is because the application does not check for endpoints which is
+    a very realistic possiblity that can occur.


This is asking about a specific specification being violated. Are you referring to a particular specification here?

nolan-white · 2023-11-12T02:11:45Z

cves/kernel/CVE-2016-2184.yml

+  answer: false
+  note: 
+    This bug does not affect internationalization as it only impacts
+    being able to connect to USB devices


Missing period at end of sentence.

nolan-white · 2023-11-12T02:12:13Z

cves/kernel/CVE-2016-2184.yml

@@ -282,8 +304,9 @@ ipc:
    Answer must be true or false.
    Write a note about how you came to the conclusions you did, regardless of
    what your answer was.
-  answer:
+  answer: ture


Typo in "ture".

nolan-white · 2023-11-12T02:12:48Z

cves/kernel/CVE-2016-2184.yml

  note:
+    This is because the bug impacts the usb connection which transfers data using packets


"usb" should be "USB". Also missing period at end of sentence.

nolan-white · 2023-11-12T02:19:35Z

cves/kernel/CVE-2016-2184.yml

  note:
+    There was a message sent explaing the details of the bug that included a 


Typo in "explaing".

nolan-white · 2023-11-12T02:21:39Z

cves/kernel/CVE-2016-2184.yml

@@ -453,6 +485,9 @@ mistakes:
    Write a thoughtful entry here that people in the software engineering
    industry would find interesting.
  answer:
+    The main mistake that was made in this application was not sanitizng
+    the inputs to check and see if there was moe than one endpoint connected
+    via USB


Typo in "sanitizng". Also missing period at end of sentence.

nolan-white · 2023-11-12T02:33:17Z

cves/kernel/CVE-2016-2184.yml

Borna5356 added 2 commits November 7, 2023 14:40

Finished Researching the CVE

dd520bc

Finished researching CVE-2016-2184

62037be

724jth reviewed Nov 9, 2023

View reviewed changes

jym2584 reviewed Nov 10, 2023

View reviewed changes

Fixed an spelling error

e440742

andymeneely added the cohort N label Nov 10, 2023

andymeneely reviewed Nov 11, 2023

View reviewed changes

Fixed YAML formatting

6f0a233

nolan-white reviewed Nov 12, 2023

View reviewed changes

cves/kernel/CVE-2016-2184.yml Outdated

note:

There was a message sent explaing the details of the bug that included a

Copy link

nolan-white Nov 12, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo in "explaing".

nolan-white reviewed Nov 12, 2023

View reviewed changes

cves/kernel/CVE-2016-2184.yml

Copy link

nolan-white Nov 12, 2023

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

7 upvotes

Borna5356 added 3 commits November 12, 2023 12:09

Fixed the lines 'jym2584' commented on

c4678d6

Fixed the lines 'Nolan White' commented on

f258059

Added the number of upvotes to my CVE

8d8179c

		note:
		This is because the on the commit message fixing the bug it was signed off bu both Eric Dumazet and

		note:
		This vulnerability directly affected UDP connection as it was interuptin the

		note:
		This is because the bug impacts the usb connection which transfers data using packets

		note: The reason the error was happening was because there was nothing checking
		the endpoint value

		note:
		There was a message sent explaing the details of the bug that included a

CVE-2015-5366 and CVE-2016-2184 #213

Are you sure you want to change the base?

CVE-2015-5366 and CVE-2016-2184 #213

Conversation

Borna5356 commented Nov 8, 2023

Choose a reason for hiding this comment

jym2584 left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

andymeneely left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nolan-white Nov 12, 2023 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

nolan-white Nov 12, 2023 •

edited

Loading