linux-hardening - Re: CVE-2024-40938: landlock: Fix d

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240715.seingevie9Ph@digikod.net>
Date: Mon, 15 Jul 2024 20:04:21 +0200
From: Mickaël Salaün <mic@...ikod.net>
To: Kees Cook <kees@...nel.org>
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>, cve@...nel.org, 
	linux-kernel@...r.kernel.org, Günther Noack <gnoack@...gle.com>, 
	linux-security-module@...r.kernel.org, linux-hardening@...r.kernel.org
Subject: Re: CVE-2024-40938: landlock: Fix d_parent walk

On Mon, Jul 15, 2024 at 09:11:35AM -0700, Kees Cook wrote:
> On Mon, Jul 15, 2024 at 02:20:59PM +0200, Mickaël Salaün wrote:
> > On Mon, Jul 15, 2024 at 01:16:38PM +0200, Greg Kroah-Hartman wrote:
> > > On Mon, Jul 15, 2024 at 12:37:53PM +0200, Mickaël Salaün wrote:
> > > > Hello,
> > > > 
> > > > AFAIK, commit 88da52ccd66e ("landlock: Fix d_parent walk") doesn't fix a
> > > > security issue but an unexpected case.  The triggered WARN_ON_ONCE() is
> > > > just a canary, and this case was correctly handled with defensive
> > > > programming and didn't allow to bypass the security policy nor to harm
> > > > the kernel.  However, this fix should indeed be backported.
> > > 
> > > If a WARN_ON() is hit, a machine with panic_on_warn enabled will reboot,
> > > hence if there is any way that userspace can hit this, it needs to be
> > > issued a CVE, sorry.
> > 
> > OK, I didn't know about this panic_on_warn rule for CVE.  Out of
> > curiosity, panic_on_warn is definitely useful for fuzzing and testing,
> > but what is the rational to enable panic_on_warn on production systems?
> > It literally transforms a warning message into a system DoS (i.e.
> > WARN_ON into BUG_ON).  We should explicitly use BUG_ON() if this is a
> > critical unhandled case, right?
> 
> We need a way to raise WARN to panic for deployments that have tested
> their workloads and want FORTIFY_SOURCE and UBSAN_BOUNDS to actually

OK, I guess it makes sense if we know and tested all the possible
execution paths and states, which is challenging, but I get your point.
However, for this use case, I don't see the point of promoting a WARN_ON
issue to a CVE.

> perform mitigations instead of just warning. Linus rejected all prior
> knobs for this and panic_on_warn (or better yet, kernel.warn_limit
> syscall) is used for this purpose.
> 
> Userspace actions must never be able to reach a WARN or BUG state:
> https://docs.kernel.org/process/deprecated.html#bug-and-bug-on

Yes, that's why we use WARN_ON_ONCE() to check cases that should never
happen (at the time of writting), but in practice it's useful to check
(with fuzzing) that this assertion is true.  However, if a
WARN_ON_ONCE() is reached, this doesn't mean that this is a security
issue, but just an unexpected case that kernel maintainers should be
notified with to fix it.