“CVE-2012-6657 and CVE-2019-15216”. #219

JoeWesn · 2023-11-09T01:20:47Z

No description provided.

Chsalinetti

Overall pretty good, I would just try and go more in depth on some things.

Chsalinetti · 2023-11-13T17:33:20Z

cves/kernel/CVE-2012-6657.yml

+  answer: lapse - Forgot to check if socket was RAW
 CWE_instructions: |


Try and go more in depth about the specifics of this issue.

Chsalinetti · 2023-11-13T17:35:39Z

cves/kernel/CVE-2012-6657.yml

 - commit: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
-  note: Discovered automatically by archeogit.
+  note: Manually verified
 upvotes_instructions: |


For this vulnerability, I'd give it a 2.

Chsalinetti · 2023-11-13T17:36:52Z

cves/kernel/CVE-2019-15216.yml

-  answer:
-  note:
+  answer: false
+  note: Out of order


What do you mean by out of order?

Chsalinetti · 2023-11-13T17:37:35Z

cves/kernel/CVE-2019-15216.yml

    Write a thoughtful entry here that people in the software engineering
    industry would find interesting.
-  answer:
+  answer: The main mistake was a lack of critical thinking about order of operations.


Again, try and go more in depth here with specifics.

Chsalinetti · 2023-11-13T17:38:21Z

cves/kernel/CVE-2019-15216.yml

 - commit: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c
-  note: Discovered automatically by archeogit.
+  note: Manually verified
 upvotes_instructions: |


This vulnerability actually seems pretty interesting given its about USB ports and existed for so long. I'll give it a 6

evstod · 2023-11-13T20:21:27Z

cves/kernel/CVE-2012-6657.yml

-  answer:
-  note:
+  answer: false
+  note: n/a


Check the commit message. I see two acknowledgements of people that signed off.

evstod · 2023-11-13T20:21:44Z

cves/kernel/CVE-2012-6657.yml

-  answer:
-  note:
+  answer: false
+  note: Not part of IPC


How so? It is my understanding that sockets are inherently inter-process.

evstod · 2023-11-13T20:26:16Z

cves/kernel/CVE-2012-6657.yml

-  answer:
+  answer: lapse - Forgot to check if socket was RAW
 CWE_instructions: |
  Please go to http://cwe.mitre.org and find the most specific, appropriate CWE


CWE 264 is a category. It may be worth looking for a specific CWE in that category.

evstod · 2023-11-13T20:32:41Z

cves/kernel/CVE-2012-6657.yml

    note:
  distrust_input:
-    applies:
+    applies: false


The socket type being sent by the user/process counts as input. This input is not being checked fully. I would propose this to count under distrust_input.

evstod · 2023-11-13T20:35:47Z

cves/kernel/CVE-2019-15216.yml

-  answer:
-  note:
+  answer: false
+  note: Was in drivers.


Expand. The subsystem it's in does not define whether or not it is ipc.

evstod · 2023-11-13T20:38:30Z

cves/kernel/CVE-2019-15216.yml

    Write a note about how you came to the conclusions you did, regardless of what your answer was.
-  answer:
-  note:
+  answer: false


I see one acknowledgement of a person who signed-off in the commit message

evstod · 2023-11-13T20:42:17Z

cves/kernel/CVE-2012-6657.yml

 - commit: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2
-  note: Discovered automatically by archeogit.
+  note: Manually verified
 upvotes_instructions: |


evstod · 2023-11-13T20:43:30Z

cves/kernel/CVE-2019-15216.yml

 - commit: 6bc235a2e24a5ef677daee3fd4f74f6cd643e23c
-  note: Discovered automatically by archeogit.
+  note: Manually verified
 upvotes_instructions: |


This taught me a lot about the interesting parts of driver handling. 4 upvotes.

Patrick-Sorensen

Overall good work! I made a couple suggestions but for the most part if I didn't comment on something I most likely think it's fine as is.

There's a couple sections you could expand upon, especially the description and mistakes answers. These are most important for readers to understand what the vulnerability was and how to avoid it in the future.

My comments are only suggestions, you don't have to accept all of them but please take them into consideration.

Additionally please add 3 upvotes to CVE-2012-6657

I found it interesting that a local user could use RAW sockets in this way, as well as how such a small oversight could crash the whole system

Add 5 upvotes to CVE-2019-15216

I found it interesting how long it lasted for before it was found, and the fact a fuzzer was able to finally detect it

Patrick-Sorensen · 2023-11-13T19:37:33Z

cves/kernel/CVE-2012-6657.yml

  security
-description:
+description: The function sock_setsockopt does not check the type of socket before running tcp_set_keepalive
+  on it, users could use a RAW socket to crash the system.


This is a good start, but consider going into more detail here. Especially could explain a bit better:

What is sock_setsockopt and what was it used for?

What is tcp_set_keepalive and why is it a problem if the socket type is not checked?

What is a RAW socket and how would it result in a system crash?

From the question description, this section should be explained as if you don't have a background in security. From just reading this response it's not quite clear what the vulnerability was. Adding details in layman's terms describing what this issue actually was would be more helpful for future readers.

Patrick-Sorensen · 2023-11-13T19:42:32Z

cves/kernel/CVE-2012-6657.yml

-  automated:
-  contest:
-  developer:
+  answer: Discovered by a developer, no used of tools were mentioned.


Small rewording change could be made here for clarification

Suggested change

answer: Discovered by a developer, no used of tools were mentioned.

answer: Discovered by a developer and no use of automated tools was mentioned.

Patrick-Sorensen · 2023-11-14T21:47:00Z

cves/kernel/CVE-2012-6657.yml

-  answer:
-  note:
+  answer: false
+  note: Not part of IPC


I believe this should instead be true, as the vulnerability was caused by an improper passing of sockets which is an IPC mechanism

Patrick-Sorensen · 2023-11-14T21:50:00Z

cves/kernel/CVE-2012-6657.yml

-  answer:
-  note:
+  answer: false
+  note: n/a


I believe this would be true, as the fix commit has three developers who reviewed and signed off on it
torvalds/linux@3e10986

Patrick-Sorensen · 2023-11-14T21:51:02Z

cves/kernel/CVE-2012-6657.yml

+  answer: Discovered by a developer, no used of tools were mentioned.
+  automated: false
+  contest: false
+  developer: false


The fix commit was signed off by a google employee so the developer flag should be true

Patrick-Sorensen · 2023-11-15T03:29:36Z

cves/kernel/CVE-2012-6657.yml

-nickname:
-CVSS:
+nickname: Socket type non check.
+CVSS:


Looks like this vulnerability has not yet been provided a 3.1 CVSS score, but instead you could use the 2.0 CVSS from "https://nvd.nist.gov/vuln/detail/CVE-2012-6657"

Suggested change

CVSS:

CVSS: CVSS:2.0AV:L/AC:L/Au:N/C:N/I:N/A:C

Patrick-Sorensen · 2023-11-15T03:48:19Z

cves/kernel/CVE-2019-15216.yml

    why you come to that conclusion.
-  note:
-  answer:
+  note: Yes, a fuzzer found the issue in this case.


This is a good start but consider expanding on it a bit. For instance, you could emphasize that yes this vulnerability can be discovered through automated means because it actually was discovered this way. You could also give a bit more detail on why this type of vulnerability is autodiscoverable.

Patrick-Sorensen · 2023-11-15T03:59:15Z

cves/kernel/CVE-2019-15216.yml

  security
-description:
+description: When a USB device is unplugged, the system attempts to log a message
+    using the device's name AFTER it has been unregistered and name deallocated, causing an error.


This is a good description that is easy to read and understand. I would just mention that this vulnerability results specifically in a NULL pointer dereference which could be exploited to cause a denial of service .

Also try to ensure you remain consistent in not going over the 80 char line limit

Patrick-Sorensen · 2023-11-15T04:08:30Z

cves/kernel/CVE-2019-15216.yml

-  answer:
-  note:
+  answer: false
+  note: Out of order


I believe this may actually be true in your case, since the USB driver created a NULL pointer and the system wasn't able to handle it causing an error, both of which were forgotten checks that the system should have been able to catch before it became a vulnerability.

Patrick-Sorensen · 2023-11-15T04:10:10Z

cves/kernel/CVE-2019-15216.yml

    free to give it a small name and add one in the same format as these.
  defense_in_depth:
-    applies:
+    applies: false


This sounds like it could be a defense in depth issue as well, as once the NULL pointer was passed the system had no deeper security to handle the error

jgw6160 added 14 commits November 8, 2023 16:54

Add CVEs

aeedf6d

Changed curation level to 2

5fff135

Removed files

d82714e

Changed level to 2

d83cc8d

Donei tihnk

620f9eb

Fixed yml error

efcf87d

Fixed more

5b1e895

Fix syntax

af81adf

A

6dc07b5

2012 fixed

48c3b45

Fixing 2019

acbe073

Fixed syn

2c41863

Removed :

f8b8b4c

Fixed 2019

86c3665

andymeneely added the cohort T label Nov 10, 2023

Chsalinetti reviewed Nov 13, 2023

View reviewed changes

evstod suggested changes Nov 13, 2023

View reviewed changes

evstod reviewed Nov 13, 2023

View reviewed changes

Patrick-Sorensen reviewed Nov 15, 2023

View reviewed changes

Added upvotes

9e47409

		answer: lapse - Forgot to check if socket was RAW
		CWE_instructions: \|

	answer: Discovered by a developer, no used of tools were mentioned.
	answer: Discovered by a developer and no use of automated tools was mentioned.

“CVE-2012-6657 and CVE-2019-15216”. #219

Are you sure you want to change the base?

“CVE-2012-6657 and CVE-2019-15216”. #219

Uh oh!

Conversation

JoeWesn commented Nov 9, 2023

Uh oh!

Chsalinetti left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Patrick-Sorensen left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants