linux-cve-announce - CVE-2021-46936: net: fix use-after-free in tw_timer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2024022751-CVE-2021-46936-2f8a@gregkh>
Date: Tue, 27 Feb 2024 10:48:57 +0100
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-cve-announce@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: CVE-2021-46936: net: fix use-after-free in tw_timer_handler

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: fix use-after-free in tw_timer_handler

A real world panic issue was found as follow in Linux 5.4.

    BUG: unable to handle page fault for address: ffffde49a863de28
    PGD 7e6fe62067 P4D 7e6fe62067 PUD 7e6fe63067 PMD f51e064067 PTE 0
    RIP: 0010:tw_timer_handler+0x20/0x40
    Call Trace:
     <IRQ>
     call_timer_fn+0x2b/0x120
     run_timer_softirq+0x1ef/0x450
     __do_softirq+0x10d/0x2b8
     irq_exit+0xc7/0xd0
     smp_apic_timer_interrupt+0x68/0x120
     apic_timer_interrupt+0xf/0x20

This issue was also reported since 2017 in the thread [1],
unfortunately, the issue was still can be reproduced after fixing
DCCP.

The ipv4_mib_exit_net is called before tcp_sk_exit_batch when a net
namespace is destroyed since tcp_sk_ops is registered befrore
ipv4_mib_ops, which means tcp_sk_ops is in the front of ipv4_mib_ops
in the list of pernet_list. There will be a use-after-free on
net->mib.net_statistics in tw_timer_handler after ipv4_mib_exit_net
if there are some inflight time-wait timers.

This bug is not introduced by commit f2bf415cfed7 ("mib: add net to
NET_ADD_STATS_BH") since the net_statistics is a global variable
instead of dynamic allocation and freeing. Actually, commit
61a7e26028b9 ("mib: put net statistics on struct net") introduces
the bug since it put net statistics on struct net and free it when
net namespace is destroyed.

Moving init_ipv4_mibs() to the front of tcp_init() to fix this bug
and replace pr_crit() with panic() since continuing is meaningless
when init_ipv4_mibs() fails.

[1] https://groups.google.com/g/syzkaller/c/p1tn-_Kc6l4/m/smuL_FMAAgAJ?pli=1

The Linux kernel CVE team has assigned CVE-2021-46936 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 4.4.298 with commit 15579e1301f8
	Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 4.9.296 with commit e73164e89d1b
	Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 4.14.261 with commit 5c2fe20ad37f
	Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 4.19.224 with commit a8e1944b44f9
	Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 5.4.170 with commit fe5838c22b98
	Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 5.10.90 with commit 2386e81a1d27
	Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 5.15.13 with commit 08eacbd141e2
	Issue introduced in 2.6.27 with commit 61a7e26028b9 and fixed in 5.16 with commit e22e45fc9e41

Please see https://www.kernel.org or a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2021-46936
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/af_inet.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/15579e1301f856ad9385d720c9267c11032a5022
	https://git.kernel.org/stable/c/e73164e89d1be561228a4534e1091369ee4ba41a
	https://git.kernel.org/stable/c/5c2fe20ad37ff56070ae0acb34152333976929b4
	https://git.kernel.org/stable/c/a8e1944b44f94f5c5f530e434c5eaee787254566
	https://git.kernel.org/stable/c/fe5838c22b986c1190f1dce9aa09bf6a491c1a69
	https://git.kernel.org/stable/c/2386e81a1d277f540e1285565c9d41d531bb69d4
	https://git.kernel.org/stable/c/08eacbd141e2495d2fcdde84358a06c4f95cbb13
	https://git.kernel.org/stable/c/e22e45fc9e41bf9fcc1e92cfb78eb92786728ef0