Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE-2015-5366 and CVE-2016-2184 #213

Open
wants to merge 7 commits into
base: dev
Choose a base branch
from
Open

CVE-2015-5366 and CVE-2016-2184 #213

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
dd520bc
Finished Researching the CVE
Borna5356 Nov 7, 2023
62037be
Finished researching CVE-2016-2184
Borna5356 Nov 8, 2023
e440742
Fixed an spelling error
Borna5356 Nov 10, 2023
6f0a233
Fixed YAML formatting
Borna5356 Nov 11, 2023
c4678d6
Fixed the lines 'jym2584' commented on
Borna5356 Nov 12, 2023
f258059
Fixed the lines 'Nolan White' commented on
Borna5356 Nov 12, 2023
8d8179c
Added the number of upvotes to my CVE
Borna5356 Nov 13, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
109 changes: 74 additions & 35 deletions cves/kernel/CVE-2015-5366.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,7 +55,10 @@ description_instructions: |

Your target audience is people just like you before you took any course in
security
description:
description:
The udp_revmsg and udpv6_recvmsg functions in the linuz kernel that provide
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

linux*

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the description would be better clarified since the issues described in the git diff and patch notes could lead to a denial of service by causing an EPOLLET epoll application read outage when there's an incorrect checksum in a UDP packet.

inappropriate EAGAIN return values. This allows attackers to perform a DOS via
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Make sure you indent this text - that's probably why the yaml is broken

incorrect checksum in a UDP packet
bounty_instructions: |
If you came across any indications that a bounty was paid out for this
vulnerability, fill it out here. Or correct it if the information already here
Expand All @@ -75,7 +78,7 @@ bugs_instructions: |
* Mentioned in mailing list discussions
* References from NVD entry
* Various other places
bugs: []
bugs: ["1478843", "1479369", "1479370"]
fixes_instructions: |
Please put the commit hash in "commit" below.

Expand Down Expand Up @@ -136,9 +139,11 @@ unit_tested:
For the fix_answer below, check if the fix for the vulnerability involves
adding or improving an automated test to ensure this doesn't happen again.
code:
code_answer:
fix:
fix_answer:
code_answer:
Returns -EAGAIN to the application even if recieve queue is not empty.
This breaks the application using edge trigger epoll()
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
code_answer:
Returns -EAGAIN to the application even if recieve queue is not empty.
This breaks the application using edge trigger epoll()
code_answer: |
Returns -EAGAIN to the application even if recieve queue is not empty.
This breaks the application using edge trigger epoll()

fix: false
fix_answer: remove the code that was causing the incorrect return statement
discovered:
question: |
How was this vulnerability discovered?
Expand All @@ -153,10 +158,12 @@ discovered:

If there is no evidence as to how this vulnerability was found, then please
explain where you looked.
answer:
automated:
contest:
developer:
answer:
The vulnerability was found in a twitter message where the security team was
contacted to create the CVE,
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are you able to link the twitter message?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
answer:
The vulnerability was found in a twitter message where the security team was
contacted to create the CVE,
answer: |
The vulnerability was found in a twitter message where the security team was
contacted to create the CVE,

automated: false
contest: nil
developer: nil
autodiscoverable:
instructions: |
Is it plausible that a fully automated tool could have discovered
Expand All @@ -173,8 +180,12 @@ autodiscoverable:

The answer field should be boolean. In answer_note, please explain
why you come to that conclusion.
note:
answer:
note:
The reason why this bug can be discovered automatically is because the
bug causes a DOS attack because it causes an infinite loop making it so
that users can't get acces to the data. This can be tested automatically
by tesitng edge cases for return values.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note:
The reason why this bug can be discovered automatically is because the
bug causes a DOS attack because it causes an infinite loop making it so
that users can't get acces to the data. This can be tested automatically
by tesitng edge cases for return values.
note: |
The reason why this bug can be discovered automatically is because the
bug causes a DOS attack because it causes an infinite loop making it so
that users can't get acces to the data. This can be tested automatically
by tesitng edge cases for return values.

answer: true
specification:
instructions: |
Is there mention of a violation of a specification? For example, the POSIX
Expand All @@ -190,8 +201,10 @@ specification:

The answer field should be boolean. In answer_note, please explain
why you come to that conclusion.
note:
answer:
note:
there was no violation of a specification as the bug appeared from not
properly checking and validating the result before returning it.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note:
there was no violation of a specification as the bug appeared from not
properly checking and validating the result before returning it.
note: |
there was no violation of a specification as the bug appeared from not
properly checking and validating the result before returning it.

answer: false
subsystem:
question: |
What subsystems was the mistake in? These are WITHIN linux kernel
Expand Down Expand Up @@ -225,7 +238,7 @@ subsystem:
e.g.
name: ["subsystemA", "subsystemB"] # ok
name: subsystemA # also ok
name:
name: This bug affect the net subsystem
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would replace this with ["net", "subsystem"] to adhere to the required syntax

note:
interesting_commits:
question: |
Expand All @@ -240,9 +253,15 @@ interesting_commits:
* A significant rewrite in the git history
* Other commits that fixed a similar issue as this vulnerability
* Anything else you find interesting.
commits:
- commit:
commits:
- commit:
beb39db59d14990e401e235faf66a6b9b31240b0
note:
The reason that I found this commit interesting is because the
developer mentions that it could only be tempory solution and
says that they might return to it later. This makes it seem that
the developer was not sure if the fix would work and thought it
would just be a band-aid on the problem.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note:
The reason that I found this commit interesting is because the
developer mentions that it could only be tempory solution and
says that they might return to it later. This makes it seem that
the developer was not sure if the fix would work and thought it
would just be a band-aid on the problem.
note: |
The reason that I found this commit interesting is because the
developer mentions that it could only be tempory solution and
says that they might return to it later. This makes it seem that
the developer was not sure if the fix would work and thought it
would just be a band-aid on the problem.

- commit:
note:
i18n:
Expand All @@ -257,8 +276,10 @@ i18n:
Answer should be true or false
Write a note about how you came to the conclusions you did, regardless of
what your answer was.
answer:
note:
answer: false
note:
The main thing that was impacted this was the accesibiliy to the public becaue
the DOS would make it so that people would not be able to access the application
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note:
The main thing that was impacted this was the accesibiliy to the public becaue
the DOS would make it so that people would not be able to access the application
note: |
The main thing that was impacted this was the accesibiliy to the public becaue
the DOS would make it so that people would not be able to access the application

sandbox:
question: |
Did this vulnerability violate a sandboxing feature that the system
Expand All @@ -272,8 +293,11 @@ sandbox:
Answer should be true or false
Write a note about how you came to the conclusions you did, regardless of
what your answer was.
answer:
answer: true
note:
Since the attacker is able to cause a DOS attack because this vulnerability
it affects the accesibility of the application which interferes with
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note:
Since the attacker is able to cause a DOS attack because this vulnerability
it affects the accesibility of the application which interferes with
note: |
Since the attacker is able to cause a DOS attack because this vulnerability
it affects the accessibility of the application which interferes with

internationalization
ipc:
question: |
Did the feature that this vulnerability affected use inter-process
Expand All @@ -284,8 +308,10 @@ ipc:
Answer must be true or false.
Write a note about how you came to the conclusions you did, regardless of
what your answer was.
answer:
answer: true
note:
This vulnerability directly affected UDP connection as it was interuptin the
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

interrupting

UDP stack causing trouble with communication.
discussion:
question: |
Was there any discussion surrounding this?
Expand All @@ -312,8 +338,11 @@ discussion:
Put any links to disagreements you found in the notes section, or any other
comment you want to make.
discussed_as_security:
The discussion is talking about the security risk of the invalid checksum and
what threath it is to the system
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

threat

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
discussed_as_security:
The discussion is talking about the security risk of the invalid checksum and
what threath it is to the system
discussed_as_security: |
The discussion is talking about the security risk of the invalid checksum and
what threath it is to the system

any_discussion:
note:
https://seclists.org/oss-sec/2015/q3/10
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note:
https://seclists.org/oss-sec/2015/q3/10
note: |
https://seclists.org/oss-sec/2015/q3/10

vouch:
question: |
Was there any part of the fix that involved one person vouching for
Expand All @@ -326,8 +355,10 @@ vouch:

Answer must be true or false.
Write a note about how you came to the conclusions you did, regardless of what your answer was.
answer:
answer: true
note:
This is because the on the commit message fixing the bug it was signed off bu both Eric Dumazet and
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Typo (by)
I think it would also be good to provide a source

David S. Miller
stacktrace:
question: |
Are there any stacktraces in the bug reports?
Expand All @@ -341,9 +372,11 @@ stacktrace:
Answer must be true or false.
Write a note about how you came to the conclusions you did, regardless of
what your answer was.
any_stacktraces:
stacktrace_with_fix:
note:
any_stacktraces: false
stacktrace_with_fix: false
note: The main reason why there are no stacktraces is that the error
causes an infinite loop causing the program to hang instead of a
stack trace.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note: The main reason why there are no stacktraces is that the error
causes an infinite loop causing the program to hang instead of a
stack trace.
note: |
The main reason why there are no stacktraces is that the error
causes an infinite loop causing the program to hang instead of a
stack trace.

forgotten_check:
question: |
Does the fix for the vulnerability involve adding a forgotten check?
Expand All @@ -362,8 +395,10 @@ forgotten_check:
Answer must be true or false.
Write a note about how you came to the conclusions you did, regardless of
what your answer was.
answer:
answer: true
note:
The fix involved having to check if the return value for the udp was valid
befoe returning the value.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note:
The fix involved having to check if the return value for the udp was valid
befoe returning the value.
note: |
The fix involved having to check if the return value for the udp was valid
before returning the value.

order_of_operations:
question: |
Does the fix for the vulnerability involve correcting an order of
Expand All @@ -375,8 +410,9 @@ order_of_operations:
Answer must be true or false.
Write a note about how you came to the conclusions you did, regardless of
what your answer was.
answer:
note:
answer: false
note: This is because the only thing that needed to be change was to add a
check to make sure the return value is valid before returning.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note: This is because the only thing that needed to be change was to add a
check to make sure the return value is valid before returning.
note: |
This is because the only thing that needed to be change was to add a
check to make sure the return value is valid before returning.

lessons:
question: |
Are there any common lessons we have learned from class that apply to this
Expand All @@ -396,22 +432,22 @@ lessons:
applies:
note:
least_privilege:
applies:
applies: false
note:
frameworks_are_optional:
applies:
applies: false
note:
native_wrappers:
applies:
applies: false
note:
distrust_input:
applies:
note:
security_by_obscurity:
applies:
applies: false
note:
serial_killer:
applies:
applies: false
note:
environment_variables:
applies:
Expand All @@ -420,8 +456,10 @@ lessons:
applies:
note:
yagni:
applies:
note:
applies: true
note: This is because the check for valid return value
was not added until the developers realized that threat
actors could exploit it.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
note: This is because the check for valid return value
was not added until the developers realized that threat
actors could exploit it.
note: |
This is because the check for valid return value
was not added until the developers realized that threat
actors could exploit it.

complex_inputs:
applies:
note:
Expand Down Expand Up @@ -454,7 +492,8 @@ mistakes:

Write a thoughtful entry here that people in the software engineering
industry would find interesting.
answer:
answer: There was a lapse in judgment in that the developers forgot to
check if the return value was valid.
CWE_instructions: |
Please go to http://cwe.mitre.org and find the most specific, appropriate CWE
entry that describes your vulnerability. We recommend going to
Expand Down
Loading