Security Bulletin: CVE-2014-5332: Tegra Linux Kernel NVMap Vulnerability

CVE-2014-5332: TEGRA LINUX KERNEL NVMAP VULNERABILITY

This technical bulletin provides information about security vulnerability in Linux implementations, including those provided with NVIDIA^® Vibrante^™ Linux releases. A possible momentary memory use-after-free bug in NVMap can allow unprivileged user‑mode software to gain root access.

Vulnerability Description:

A momentary use-after-free vulnerability in the NVMap component allows a fixed single bit to clear data in a recycled memory structure. To take advantage of this vulnerability, an attacker needs to exploit the race condition that exists between the conversion of the FD to a handle structure pointer (one point in time) and the ref count increment of the handle structure (another point in time), and force the handle memory structure to be recycled in a kernel process where the fixed bit can be leveraged for exploit.

NVIDIA is not aware of any exploits that attempt to leverage this vulnerability.

Exploit Scope and Risk:

With sufficient effort and winning the race conditions, a single bit modification in the appropriate kernel structure can be leveraged into a privilege escalation of kernel, allowing for kernel compromise.

NVIDIA is not aware of any public exploits that attempt to leverage this vulnerability.

Vulnerable Configurations:

The following releases have this vulnerability and are based on the Tegra Linux Kernel version 3.10.

Android

ChromeOS

Vulnerability Discovery:

NVIDIA was alerted to this issue by Lee Campbell, Chrome Security, Google.

Resolution:

NVIDIA has released code fixes to upstream repositories and device vendors. NVIDIA recommends contacting the vendor of your device about any appropriate software updates.