Multiple memory corruption issues and race condition in Goodix gt915 touchscreen driver procfs handler (CVE-2013-4740 CVE-2013-6122)

Release Date:

November 7, 2013

Affected Projects:

Android for MSM

Advisory ID:

QCIR-2013-00009-1

CVE ID(s):

CVE-2013-4740CVE-2013-6122

Summary:

Multiple issues have been identified in the Goodix gt915 touchscreen driver for Android. The issues were found in the write handler of the procfs entry created by the driver, which by default is readable and writeable to users without any specific privileges. CVE-2013-4740: When processing data written to the procfs file, the Goodix gt915 touchscreen driver is using user space supplied content as length values in subsequent memory manipulation operations without bounds checking. This can lead to multiple memory corruption issues. An application with access to the respective file can use this flaw to, e.g., elevate privileges. Security Risk: high Vulnerability: CWE-20 (Improper Input Validation) --- CVE-2013-6122: When processing arguments passed to the procfs write handler of the Goodix gt915 touchscreen driver, user space data is copied to a global variable and used without a mutual-exclusion mechanism. The global structure used by the procfs write handler can be accessed concurrently by more than one process. This would allow local attackers to bypass the input validation checks (such as introduced by the fix for CVE-2013-4740). An application with access to the respective file can use this flaw to, e.g., alter the internal state of the handler, bypass security checks, or create a denial-of-service condition. Security Risk: medium Vulnerability: CWE-362 (Concurrent Execution using Shared Resource with Improper Synchronization)

Access Vector: Local
Security Risk:
Access Vector: Local

Affected Versions:

All Android releases from CAF using the Linux kernel from the following heads: jb_3*, msm-3.10

Patch:

We advise customers to apply the following patches:
https://www.codeaurora.org/cgit/quic/la/kernel/msm-3.10/commit/?id=f53bcf29a6e7a66b3d935b8d562fa00829261f05

Acknowledgement:

Qualcomm Innovation Center, Inc. (QuIC) thanks Jonathan Salwan of the Sysdream Security Lab for reporting the related issues and working with QuIC to help improve Android device security.

Revisions:

Initial revision

Contact:

security-advisory@quicinc.com