CVE-2016-2547 & CVE-2018-20961 by jm8084 · Pull Request #212 · VulnerabilityHistoryProject/vulnerabilities

jm8084 · 2023-11-08T04:22:56Z

First draft... Need further digging

CVE: 2016-2547, 2018-20961

bjk5739

Overall good job. Just try to rewrite short notes to be more complete and elaborate on technical terminology- both of these will show confidence in your research

bjk5739 · 2023-11-09T19:36:35Z

cves/kernel/CVE-2016-2547.yml

-description:
+description: The Advanced Linux Sound Architecture (ALSA) is a framework in the linux kernal that provides 
+  an interface for sound cards devices. The framework used a resource locking approach that did not 
+  consider slave timer instances. The instacne could still be accessed, creating  race condition 


Misspelled instance here & creating a race condition

You describe the ALSA subsystem well, but should also go into detail for terms like "slave timer" and "race condition" for those who may not be familiar with them.

bjk5739 · 2023-11-09T19:41:02Z

cves/kernel/CVE-2016-2547.yml

        name: ["subsystemA", "subsystemB"] # ok
        name: subsystemA # also ok
-  name:
+  name: sound


Instead of sound, you likely want to put drivers as the subsystem or ASLA, as you mentioned before. Sound is made up of ASLA drivers and utilities, and is not technically a subsystem.

Looking at the repository, I think it's fine actually. Sound is certainly a subsystem, and it appears that no other subsystems were involved.

bjk5739 · 2023-11-09T19:41:57Z

cves/kernel/CVE-2016-2547.yml

-  answer:
-  note:
+  answer: false
+  note: only systems using the Advanced Linux Sound Architecture (ALSA) 


This reads funny. I would recommend rephrasing

Yeah I'm unsure how this relates to i18n. Definitely review, but since it is a general sound framework, I doubt it has any notable relation to i18n.

bjk5739 · 2023-11-09T19:42:52Z

cves/kernel/CVE-2016-2547.yml

-  answer:
-  note:
+  answer: true
+  note: check if all instances are locked


In general, notes like this should be more complete to add confidence in your work

bjk5739 · 2023-11-09T19:43:24Z

cves/kernel/CVE-2016-2547.yml

    Write a thoughtful entry here that people in the software engineering
    industry would find interesting.
-  answer:
+  answer: This is a coding lapse. The developer forgot to lock all instances 


I would elaborate on locking and instances and what role they play

bjk5739 · 2023-11-09T19:44:01Z

cves/kernel/CVE-2016-2547.yml

  Must be under 30 characters. Optional.
 nickname:
-CVSS:
+CVSS: CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H


Add to upvotes (since not changed in commit): I give this a 2

bjk5739 · 2023-11-09T19:45:09Z

cves/kernel/CVE-2018-20961.yml

-  note: Discovered automatically by archeogit.
+  note: Patch meant to fix memory leak when system fails
 - commit: '079fe5a6da616891cca1a26e803e1df2a87e9ae5'
  note: Discovered automatically by archeogit.


Did you manually confirm this? Be sure to mention that if so!

bjk5739 · 2023-11-09T19:46:04Z

cves/kernel/CVE-2018-20961.yml

-  automated:
-  contest:
-  developer:
+  answer: Greg Kroah-Hartman from linux foundations 


How was it discovered? If that's not mentioned, bring that up.

bjk5739 · 2023-11-09T19:46:36Z

cves/kernel/CVE-2018-20961.yml

-  answer:
-  note:
+  answer: true
+  note: double-free can cause arbitrary code exe.


Don't shorten execution here

bjk5739 · 2023-11-09T19:47:23Z

cves/kernel/CVE-2018-20961.yml

+  answer: This is a coding lapse. The developer forgot to check if resource was already free
 CWE_instructions: |
  Please go to http://cwe.mitre.org and find the most specific, appropriate CWE
  entry that describes your vulnerability. We recommend going to


Add to Upvotes (since not changed in commit): I give this a 2

I give this 2 upvotes as well

I give this 3 upvotes

AcrylicRobin · 2023-11-13T16:20:35Z

cves/kernel/CVE-2018-20961.yml

-  fix:
-  fix_answer:
+  code: false
+  code_answer: no unit tests found in commits


In general, check your capitalization for your notes.

zmontgomery

Shows good understanding of the vulnerability but lacks some details.

EDIT: I give 3 upvotes

zmontgomery · 2023-11-19T19:05:28Z

cves/kernel/CVE-2016-2547.yml


  Please enter your date in YYYY-MM-DD format.
-reported_date:
+reported_date: '2016-02-24'


Unsure what the exact "reported" date might be, but I found bug reports as early as January 13th from the NVD references: https://lore.kernel.org/all/CACT4Y+ZrVvE3dgcYHRdHDG0X316VgC-=pr2U-233vVn_QbHZHw@mail.gmail.com/T/#u

zmontgomery · 2023-11-27T15:49:35Z

cves/kernel/CVE-2016-2547.yml

-description:
+description: The Advanced Linux Sound Architecture (ALSA) is a framework in the linux kernal that provides 
+  an interface for sound cards devices. The framework used a resource locking approach that did not 
+  consider slave timer instances. The instacne could still be accessed, creating  race condition 


You describe the ALSA subsystem well, but should also go into detail for terms like "slave timer" and "race condition" for those who may not be familiar with them.

zmontgomery · 2023-11-27T15:56:14Z

cves/kernel/CVE-2016-2547.yml

-  developer:
+  answer: Dmitry Vyukov, Google developer, discovered that the Advanced Linux Sound Architecture (ALSA)
+    framework's handling of high resolution timers did not properly manage its
+    data structures 2016-01-15


At the bottom of the fix commit, a system call fuzzer from Google (known as syzkaller) is referenced. It may be worth mentioning as it likely played a role in detecting this bug.

"Dmitry Vyukov reported a series of kernel bugs in ALSA core that have been
triggered by syzkaller fuzzer" - https://www.openwall.com/lists/oss-security/2016/01/19/1

zmontgomery · 2023-11-27T17:44:35Z

cves/kernel/CVE-2016-2547.yml

    why you come to that conclusion.
-  note:
-  answer:
+  note: fuzzer, use-after-free


This may need some expanding. Maybe give sentences, along with any related thoughts.

zmontgomery · 2023-11-27T17:49:39Z

cves/kernel/CVE-2016-2547.yml

        name: ["subsystemA", "subsystemB"] # ok
        name: subsystemA # also ok
-  name:
+  name: sound


Looking at the repository, I think it's fine actually. Sound is certainly a subsystem, and it appears that no other subsystems were involved.

zmontgomery · 2023-11-27T18:04:00Z

cves/kernel/CVE-2016-2547.yml

-  answer:
-  note:
+  answer: true
+  note: access instance that should be locked for privileged resources 


It's hard to say, but I would disagree here. Privilege doesn't seem to be the issue, instead more careful management of that resource in a multi-threaded environment.

zmontgomery · 2023-11-28T00:31:21Z

cves/kernel/CVE-2018-20961.yml


  Please enter your date in YYYY-MM-DD format.
-reported_date:
+reported_date: '2019-08-07'


It seems you didn't look very hard

zmontgomery · 2023-11-28T00:35:08Z

cves/kernel/CVE-2018-20961.yml

-description:
+description: Some USB gadgets have multiple 'modes' devices that can switch between modes 
+  and possibly cause a double-free flaw. Subsequently the USB gadget Midi driver 
+  in the Linux kernel created a double-free when handling certain errors. 


Good, but if nothing else maybe explain what a double free means/why it crashes and how it crashes

zmontgomery · 2023-11-28T00:37:25Z

cves/kernel/CVE-2018-20961.yml

    why you come to that conclusion.
-  note:
-  answer:
+  note: no tools/tests mentioned in commits


It mentions MOXCAFE. I see little info on it, but it should be mentioned as it is in the fix commit

zmontgomery · 2023-11-28T00:40:38Z

cves/kernel/CVE-2018-20961.yml

-  answer:
-  note:
+  answer: true
+  note: usb instance freed when process failed


Maybe a few more details for understanding.

jm8084 added 6 commits November 7, 2023 23:10

0

2945634

CVE-2016-2547, CVE-2018-20961

b72b269

Merge branch 'dev' of https://github.com/jm8084/jm8084vulns into dev

9f4c526

CVE: 2016-2547, 2018-20961

CVE: 2016-2547, 2018-20961

8d97b46

CVE: 2016-2547 & 2018-20961

c776fdb

CVE: 2016-2547, 2018-20961

43888ba

bjk5739 reviewed Nov 9, 2023

View reviewed changes

andymeneely added the cohort R label Nov 10, 2023

AcrylicRobin reviewed Nov 13, 2023

View reviewed changes

zmontgomery reviewed Nov 28, 2023

View reviewed changes

Conversation

jm8084 commented Nov 8, 2023

Uh oh!

bjk5739 left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

zmontgomery left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

zmontgomery left a comment •

edited

Loading