1. photon
  2. Commit d0a9fc9fb3211214585ca5c50bca2efb44612113
Browse code

socket: close race condition between sock_close() and sockfs_setattr() to fix CVE-2019-8912

Change-Id: Ibe24a7bf06fc6b04927100d97f7ce7cf355e0694
Reviewed-on: http://photon-jenkins.eng.vmware.com:8082/6778
Reviewed-by: Anish Swaminathan <anishs@vmware.com>
Tested-by: Anish Swaminathan <anishs@vmware.com>

Him Kalyan Bordoloi authored on 2019/02/22 00:43:26
Showing 3 changed files
SPECS/linux/fix_use_after_free_in_sockfs_setattr.patch
History View file @ d0a9fc9
1 1 
new file mode 100644
... ... 
@@ -0,0 +1,115 @@
0 
+KASAN has found use-after-free in sockfs_setattr.
1 
+The existed commit 6d8c50dcb029 ("socket: close race condition between sock_close()
2 
+and sockfs_setattr()") is to fix this simillar issue, but it seems to ignore
3 
+that crypto module forgets to set the sk to NULL after af_alg_release.
4 
+
5 
+KASAN report details as below:
6 
+BUG: KASAN: use-after-free in sockfs_setattr+0x120/0x150
7 
+Write of size 4 at addr ffff88837b956128 by task syz-executor0/4186
8 
+
9 
+CPU: 2 PID: 4186 Comm: syz-executor0 Not tainted xxx + #1
10 
+Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
11 
+1.10.2-1ubuntu1 04/01/2014
12 
+Call Trace:
13 
+ dump_stack+0xca/0x13e
14 
+ print_address_description+0x79/0x330
15 
+ ? vprintk_func+0x5e/0xf0
16 
+ kasan_report+0x18a/0x2e0
17 
+ ? sockfs_setattr+0x120/0x150
18 
+ sockfs_setattr+0x120/0x150
19 
+ ? sock_register+0x2d0/0x2d0
20 
+ notify_change+0x90c/0xd40
21 
+ ? chown_common+0x2ef/0x510
22 
+ chown_common+0x2ef/0x510
23 
+ ? chmod_common+0x3b0/0x3b0
24 
+ ? __lock_is_held+0xbc/0x160
25 
+ ? __sb_start_write+0x13d/0x2b0
26 
+ ? __mnt_want_write+0x19a/0x250
27 
+ do_fchownat+0x15c/0x190
28 
+ ? __ia32_sys_chmod+0x80/0x80
29 
+ ? trace_hardirqs_on_thunk+0x1a/0x1c
30 
+ __x64_sys_fchownat+0xbf/0x160
31 
+ ? lockdep_hardirqs_on+0x39a/0x5e0
32 
+ do_syscall_64+0xc8/0x580
33 
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
34 
+RIP: 0033:0x462589
35 
+Code: f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 48 89 f8 48 89
36 
+f7 48 89 d6 48 89
37 
+ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3
38 
+48 c7 c1 bc ff ff
39 
+ff f7 d8 64 89 01 48
40 
+RSP: 002b:00007fb4b2c83c58 EFLAGS: 00000246 ORIG_RAX: 0000000000000104
41 
+RAX: ffffffffffffffda RBX: 000000000072bfa0 RCX: 0000000000462589
42 
+RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000007
43 
+RBP: 0000000000000005 R08: 0000000000001000 R09: 0000000000000000
44 
+R10: 0000000000000000 R11: 0000000000000246 R12: 00007fb4b2c846bc
45 
+R13: 00000000004bc733 R14: 00000000006f5138 R15: 00000000ffffffff
46 
+
47 
+Allocated by task 4185:
48 
+ kasan_kmalloc+0xa0/0xd0
49 
+ __kmalloc+0x14a/0x350
50 
+ sk_prot_alloc+0xf6/0x290
51 
+ sk_alloc+0x3d/0xc00
52 
+ af_alg_accept+0x9e/0x670
53 
+ hash_accept+0x4a3/0x650
54 
+ __sys_accept4+0x306/0x5c0
55 
+ __x64_sys_accept4+0x98/0x100
56 
+ do_syscall_64+0xc8/0x580
57 
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
58 
+
59 
+Freed by task 4184:
60 
+ __kasan_slab_free+0x12e/0x180
61 
+ kfree+0xeb/0x2f0
62 
+ __sk_destruct+0x4e6/0x6a0
63 
+ sk_destruct+0x48/0x70
64 
+ __sk_free+0xa9/0x270
65 
+ sk_free+0x2a/0x30
66 
+ af_alg_release+0x5c/0x70
67 
+ __sock_release+0xd3/0x280
68 
+ sock_close+0x1a/0x20
69 
+ __fput+0x27f/0x7f0
70 
+ task_work_run+0x136/0x1b0
71 
+ exit_to_usermode_loop+0x1a7/0x1d0
72 
+ do_syscall_64+0x461/0x580
73 
+ entry_SYSCALL_64_after_hwframe+0x49/0xbe
74 
+
75 
+Syzkaller reproducer:
76 
+r0 = perf_event_open(&(0x7f0000000000)={0x0, 0x70, 0x0, 0x0, 0x0, 0x0,
77 
+0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
78 
+0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,
79 
+0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @perf_config_ext}, 0x0, 0x0,
80 
+0xffffffffffffffff, 0x0)
81 
+r1 = socket$alg(0x26, 0x5, 0x0)
82 
+getrusage(0x0, 0x0)
83 
+bind(r1, &(0x7f00000001c0)=@alg={0x26, 'hash\x00', 0x0, 0x0,
84 
+'sha256-ssse3\x00'}, 0x80)
85 
+r2 = accept(r1, 0x0, 0x0)
86 
+r3 = accept4$unix(r2, 0x0, 0x0, 0x0)
87 
+r4 = dup3(r3, r0, 0x0)
88 
+fchownat(r4, &(0x7f00000000c0)='\x00', 0x0, 0x0, 0x1000)
89 
+
90 
+Fixes: 6d8c50dcb029 ("socket: close race condition between sock_close() and sockfs_setattr()")
91 
+Signed-off-by: Mao Wenan <maowenan@huawei.com>
92 
+---
93 
+ crypto/af_alg.c | 4 +++-
94 
+ 1 file changed, 3 insertions(+), 1 deletion(-)
95 
+
96 
+diff --git a/crypto/af_alg.c b/crypto/af_alg.c
97 
+index 17eb09d..ec78a04 100644
98 
+--- a/crypto/af_alg.c
99 
+@@ -122,8 +122,10 @@ static void alg_do_release(const struct af_alg_type *type, void *private)
100 
+
101 
+ int af_alg_release(struct socket *sock)
102 
+ {
103 
+-	if (sock->sk)
104 
++	if (sock->sk) {
105 
+ 		sock_put(sock->sk);
106 
++		sock->sk = NULL;
107 
++	}
108 
+ 	return 0;
109 
+ }
110 
+ EXPORT_SYMBOL_GPL(af_alg_release);
111 
+--
112 
+2.7.4
113 
+
SPECS/linux/linux-esx.spec
History View file @ d0a9fc9
... ... 
@@ -2,7 +2,7 @@
2 2 
 Summary:       Kernel
3 3 
 Name:          linux-esx
4 4 
 Version:       4.4.171
5 
-Release:       1%{?dist}
5 
+Release:       2%{?dist}
6 6 
 License:       GPLv2
7 7 
 URL:           http://www.kernel.org/
8 8 
 Group:         System Environment/Kernel
... ... 
@@ -62,6 +62,8 @@ Patch46:        0006-xfs-verify-dinode-header-first.patch
62 62 
 Patch47:        0007-xfs-move-inode-fork-verifiers-to-xfs_dinode_verify.patch
63 63 
 Patch48:        0008-xfs-enhance-dinode-verifier.patch
64 64 
 Patch49:        net-9p-vdfs-zerocopy.patch
65 
+#Fix CVE-2019-8912
66 
+Patch50:        fix_use_after_free_in_sockfs_setattr.patch
65 67
66 68 
 # For Spectre
67 69 
 Patch67: 0169-x86-syscall-Clear-unused-extra-registers-on-syscall-.patch
... ... 
@@ -145,6 +147,7 @@ The Linux package contains the Linux kernel doc files
145 145 
 %patch47 -p1
146 146 
 %patch48 -p1
147 147 
 %patch49 -p1
148 
+%patch50 -p1
148 149
149 150 
 %patch67 -p1
150 151
... ... 
@@ -235,6 +238,8 @@ ln -sf linux-%{uname_r}.cfg /boot/photon.cfg
235 235 
 /usr/src/linux-headers-%{uname_r}
236 236
237 237 
 %changelog
238 
+*   Thu Feb 21 2019 Him Kalyan Bordoloi <bordoloih@vmware.com> 4.4.171-2
239 
+-   Fix CVE-2019-8912
238 240 
 *   Thu Jan 24 2019 Ajay Kaher <akaher@vmware.com> 4.4.171-1
239 241 
 -   Update to version 4.4.171
240 242 
 *   Wed Dec 12 2018 Kamal Charan <kcharan@vmware.com> 4.4.164-2
SPECS/linux/linux.spec
History View file @ d0a9fc9
... ... 
@@ -2,7 +2,7 @@
2 2 
 Summary:        Kernel
3 3 
 Name:           linux
4 4 
 Version:    	4.4.171
5 
-Release:        2%{?kat_build:.%kat_build}%{?dist}
5 
+Release:        3%{?kat_build:.%kat_build}%{?dist}
6 6 
 License:    	GPLv2
7 7 
 URL:        	http://www.kernel.org/
8 8 
 Group:        	System Environment/Kernel
... ... 
@@ -63,6 +63,8 @@ Patch41:        0008-xfs-enhance-dinode-verifier.patch
63 63 
 Patch42:        net-9p-vdfs-zerocopy.patch
64 64 
 # Fix for CVE-2018-16882
65 65 
 Patch43:        0001-KVM_Fix_UAF_in_nested_posted_interrupt_processing.patch
66 
+#Fix CVE-2019-8912
67 
+Patch44:        fix_use_after_free_in_sockfs_setattr.patch
66 68
67 69 
 # For Spectre
68 70 
 Patch67: 0169-x86-syscall-Clear-unused-extra-registers-on-syscall-.patch
... ... 
@@ -180,6 +182,7 @@ This package contains the 'perf' performance analysis tools for Linux kernel.
180 180 
 %patch41 -p1
181 181 
 %patch42 -p1
182 182 
 %patch43 -p1
183 
+%patch44 -p1
183 184
184 185 
 %patch67 -p1
185 186
... ... 
@@ -338,6 +341,8 @@ ln -sf %{name}-%{uname_r}.cfg /boot/photon.cfg
338 338 
 /usr/share/perf-core
339 339
340 340 
 %changelog
341 
+*   Thu Feb 21 2019 Him Kalyan Bordoloi <bordoloih@vmware.com> 4.4.171-3
342 
+-   Fix CVE-2019-8912
341 343 
 *   Wed Jan 30 2019 Ajay Kaher <akaher@vmware.com> 4.4.171-2
342 344 
 -   Fix CVE-2018-16882
343 345 
 *   Thu Jan 24 2019 Ajay Kaher <akaher@vmware.com> 4.4.171-1