Sign-up

ID

VAR-201402-0147


CVE

CVE-2013-4739


TITLE

MSM For devices Qualcomm Innovation Center Android Used for contributions etc. Linux Kernel for MSM Vulnerability in camera driver to obtain important information

Trust: 0.8

sources: JVNDB: JVNDB-2013-005980

DESCRIPTION

The MSM camera driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Android contributions for MSM devices and other products, allows attackers to obtain sensitive information from kernel stack memory via (1) a crafted MSM_MCR_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v1/mercury/msm_mercury_sync.c, or (2) a crafted MSM_JPEG_IOCTL_EVT_GET ioctl call, related to drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.c. (1) drivers/media/platform/msm/camera_v1/mercury/msm_mercury_sync.c (2) drivers/media/platform/msm/camera_v2/jpeg_10/msm_jpeg_sync.cAn attacker could gain privileges through the following items: (1) Cleverly crafted MSM_MCR_IOCTL_EVT_GET System call (2) Cleverly crafted MSM_JPEG_IOCTL_EVT_GET System call. Android for MSM project is prone to multiple information-disclosure vulnerabilities. Local attackers can exploit these issues to obtain sensitive information that may aid in launching further attacks. MSM camera driver for the Linux kernel is a Qualcomm platform camera driver project based on the Linux kernel. *Description* A stack-based buffer overflow and a kernel memory disclosure vulnerability have been discovered in the system call handlers of the camera driver. *CVE-2013-4738* The camera post processing engine (CPP) and video processing engine (VPE) provide an ioctl system call interface to user space clients for communication. When processing arguments passed to the VIDIOC_MSM_CPP_DEQUEUE_STREAM_BUFF_INFO or VIDIOC_MSM_VPE_DEQUEUE_STREAM_BUFF_INFO ioctl subdev handlers, a user space supplied length value is used to copy memory to a local stack buffer without proper bounds checking. An application with access to the respective device nodes can use this flaw to, e.g., elevate privileges. Access Vector: local Security Risk: high Vulnerability: CWE-121 (stack-based buffer overflow) *CVE-2013-4739* The Gemini JPEG encoder and the Jpeg1.0 common encoder/decoder engines of the camera driver are not properly initializing all members of a structure before copying it to user space. Access Vector: local Security Risk: low Vulnerability: CWE-200 (information exposure) *Affected versions* All Android releases from CAF using a Linux kernel from the following heads: - msm-3.4 - jb_3* *Patch* We advise customers to apply the following patches: CVE-2013-4738: - https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=c9c81836ee44db9974007d34cf2aaeb1a51a8d45 - https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=28385b9c3054c91dca1aa194ffa750550c50f3ce CVE-2013-4739: - https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8604847927f952cc8e773b97eca24e1060a570f2 *Credits* Reported by the researcher Jonathan Salwan and patched by Qualcomm Innovation Center

Trust: 2.07

sources: NVD: CVE-2013-4739 // JVNDB: JVNDB-2013-005980 // BID: 63264 // VULHUB: VHN-64741 // PACKETSTORM: 123704

AFFECTED PRODUCTS

vendor:qualcommmodel:quic mobile station modem kernelscope:eqversion:3.4

Trust: 1.6

vendor:codeauroramodel:android-msmscope:eqversion:2.6.29

Trust: 1.0

vendor:android for msmmodel:android for msmscope:eqversion:2.6.29

Trust: 0.8

vendor:qualcommmodel:quic mobile station modemscope:eqversion:3.4

Trust: 0.8

sources: JVNDB: JVNDB-2013-005980 // CNNVD: CNNVD-201310-659 // NVD: CVE-2013-4739

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-4739
value: MEDIUM

Trust: 1.0

NVD: CVE-2013-4739
value: MEDIUM

Trust: 0.8

CNNVD: CNNVD-201310-659
value: MEDIUM

Trust: 0.6

VULHUB: VHN-64741
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2013-4739
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:C/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

VULHUB: VHN-64741
severity: MEDIUM
baseScore: 4.9
vectorString: AV:L/AC:L/AU:N/C:C/I:N/A:N
accessVector: LOCAL
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 6.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: VULHUB: VHN-64741 // JVNDB: JVNDB-2013-005980 // CNNVD: CNNVD-201310-659 // NVD: CVE-2013-4739

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.9

sources: VULHUB: VHN-64741 // JVNDB: JVNDB-2013-005980 // NVD: CVE-2013-4739

THREAT TYPE

local

Trust: 0.9

sources: BID: 63264 // CNNVD: CNNVD-201310-659

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-201310-659

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-005980

PATCH
title:QCIR-2013-00008-1url:https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-and-memory-disclosure-camera-driver-cve-2013-4738-cve-2013-4739
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-005980

EXTERNAL IDS
db:NVDid:CVE-2013-4739
Trust: 2.9
db:OPENWALLid:OSS-SECURITY/2013/10/15/4
Trust: 1.7
db:BIDid:63264
Trust: 1.0
db:JVNDBid:JVNDB-2013-005980
Trust: 0.8
db:CNNVDid:CNNVD-201310-659
Trust: 0.7
db:MLISTid:[OSS-SECURITY] 20131015 REPORT - STACK-BASED BUFFER OVERFLOW AND MEMORY DISCLOSURE IN CAMERA DRIVER (CVE-2013-4748 CVE-2013-4739)
Trust: 0.6
db:VULHUBid:VHN-64741
Trust: 0.1
db:PACKETSTORMid:123704
Trust: 0.1
sources:
            
            
            VULHUB: VHN-64741 // 
            
            
            
            BID: 63264 // 
            
            
            
            JVNDB: JVNDB-2013-005980 // 
            
            
            
            PACKETSTORM: 123704 // 
            
            
            
            CNNVD: CNNVD-201310-659 // 
            
            
            
            NVD: CVE-2013-4739

REFERENCES
url:https://www.codeaurora.org/projects/security-advisories/stack-based-buffer-overflow-and-memory-disclosure-camera-driver-cve-2013-4748-cve-2013-4739
Trust: 1.7
url:http://www.openwall.com/lists/oss-security/2013/10/15/4
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-4739
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2013-4739
Trust: 0.8
url:http://www.securityfocus.com/bid/63264
Trust: 0.6
url:https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=8604847927f952cc8e773b97eca24e1060a570f2
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-4739
Trust: 0.1
url:https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=28385b9c3054c91dca1aa194ffa750550c50f3ce
Trust: 0.1
url:https://www.codeaurora.org/cgit/quic/la/kernel/msm/commit/?id=c9c81836ee44db9974007d34cf2aaeb1a51a8d45
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-4738
Trust: 0.1
sources:
            
            
            VULHUB: VHN-64741 // 
            
            
            
            JVNDB: JVNDB-2013-005980 // 
            
            
            
            PACKETSTORM: 123704 // 
            
            
            
            CNNVD: CNNVD-201310-659 // 
            
            
            
            NVD: CVE-2013-4739

CREDITS
Jonathan Salwan of the Sysdream Security Lab
Trust: 0.9
sources:
            
            
            BID: 63264 // 
            
            
            
            CNNVD: CNNVD-201310-659

SOURCES
db:VULHUBid:VHN-64741
db:BIDid:63264
db:JVNDBid:JVNDB-2013-005980
db:PACKETSTORMid:123704
db:CNNVDid:CNNVD-201310-659
db:NVDid:CVE-2013-4739

LAST UPDATE DATE
2024-11-23T22:31:20.842000+00:00

SOURCES UPDATE DATE
db:VULHUBid:VHN-64741date:2014-02-07T00:00:00
db:BIDid:63264date:2015-03-19T09:31:00
db:JVNDBid:JVNDB-2013-005980date:2014-02-05T00:00:00
db:CNNVDid:CNNVD-201310-659date:2014-02-08T00:00:00
db:NVDid:CVE-2013-4739date:2024-11-21T01:56:15.680

SOURCES RELEASE DATE
db:VULHUBid:VHN-64741date:2014-02-03T00:00:00
db:BIDid:63264date:2013-10-15T00:00:00
db:JVNDBid:JVNDB-2013-005980date:2014-02-05T00:00:00
db:PACKETSTORMid:123704date:2013-10-21T22:22:22
db:CNNVDid:CNNVD-201310-659date:2013-10-15T00:00:00
db:NVDid:CVE-2013-4739date:2014-02-03T03:55:03.723