CVE-2014-8612 FreeBSD SCTP Socket SCTP_SS_VALUE Kernel Memory 16bit read/write

[SynQ]

FreeBSD-SA-15:02.kmem / CVE-2014-8612

Announced:      2015-01-27
Credits:        Clement LECIGNE from Google Security Team and
                Francisco Falcon from Core Security Technologies
Affects:        All supported versions of FreeBSD.
Corrected:      2015-01-27 19:36:08 UTC (stable/10, 10.1-STABLE)
                2015-01-27 19:37:02 UTC (releng/10.1, 10.1-RELEASE-p5)
                2015-01-27 19:37:02 UTC (releng/10.0, 10.0-RELEASE-p17)
                2015-01-27 19:36:08 UTC (stable/9, 9.3-STABLE)
                2015-01-27 19:37:02 UTC (releng/9.3, 9.3-RELEASE-p9)
                2015-01-27 19:36:08 UTC (stable/8, 8.4-STABLE)
                2015-01-27 19:37:02 UTC (releng/8.4, 8.4-RELEASE-p23)

I. Background

SCTP protocol provides reliable, flow-controlled, two-way transmission
of data. It is a message oriented protocol and can support the SOCK_STREAM
and SOCK_SEQPACKET abstractions.

SCTP allows the user to choose between multiple scheduling algorithms to
optimize the sending behavior of SCTP in scenarios with different
requirements.

II. Problem Description

Due to insufficient validation of the SCTP stream ID, which serves as an array
index, a local unprivileged attacker can read or write 16-bits of kernel
memory.

Не проверяется индекс массива, соответственно можно читать/писать за его пределами в ядре.

Хорошее описание и poc:
http://www.coresecurity.com/advisori...ulnerabilities

[Tim]

Есть что-то рабочее на эту багу?

Проверял POС на FreeBSD 9.1-RELEASE #0 r243825 amd64
Второй POС ребутит систему,
а третий вроде что-то читает.

"[*] Value leaked from kernel: 0x0900

Как это можно использовать?