linux-kernel - NULL-ptr deref in kvm_arch_vcpu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Date:	Fri, 19 Feb 2016 15:06:58 +0100
From:	Robert Święcki <robert@...ecki.net>
To:	LKML <linux-kernel@...r.kernel.org>
Cc:	Dmitry Vyukov <dvyukov@...gle.com>,
	Paolo Bonzini <pbonzini@...hat.com>,
	Borislav Petkov <bp@...en8.de>
Subject: NULL-ptr deref in kvm_arch_vcpu_ioctl under AMD CPUs

Hi,

This seems non-exploitable due to mmap_min_addr, so I guess it should
be treated just as a regular bug

Tested with 4.5-rc4 and with 4.4 under Opteron 6272 and FX-8320

[167193.153283] BUG: unable to handle kernel NULL pointer dereference
at 00000000000000f0
[167193.153372] IP: [<ffffffffc0545067>] kvm_arch_vcpu_ioctl+0x417/0x1120 [kvm]
[167193.153453] PGD fca0067 PUD 79907067 PMD 0
[167193.153503] Oops: 0000 [#1] SMP
[167193.153571] Modules linked in: binfmt_misc nls_utf8 btrfs xor
raid6_pq ufs qnx4 hfsplus hfs minix ntfs msdos jfs xfs libcrc32c
kvm_amd amd64_edac_mod input_leds joydev kvm snd_pcm snd_timer
edac_mce_amd edac_core snd i2c_piix4 irqbypass fam15h_power
tpm_infineon shpchp k10temp crct10dif_pclmul crc32_pclmul aesni_intel
psmouse evbug soundcore aes_x86_64 mac_hid lrw 8250_fintek gf128mul
serio_raw glue_helper pcspkr ablk_helper cryptd ipmi_ssif
ipmi_watchdog ipmi_si ipmi_poweroff ipmi_devintf ipmi_msghandler
autofs4 pata_acpi hid_generic usbkbd usbmouse usbhid hid igb
i2c_algo_bit dca ahci ptp pata_atiixp libahci pps_core fjes
[167193.154119] CPU: 3 PID: 22154 Comm: z Not tainted 4.4.0-4-generic #19-Ubuntu
[167193.154173] Hardware name: HP ProLiant DL165 G7, BIOS O37 02/02/2012
[167193.154224] task: ffff8801fe899b80 ti: ffff88005ff30000 task.ti:
ffff88005ff30000
[167193.154304] RIP: 0010:[<ffffffffc0545067>]  [<ffffffffc0545067>]
kvm_arch_vcpu_ioctl+0x417/0x1120 [kvm]
[167193.154397] RSP: 0018:ffff88005ff33d28  EFLAGS: 00010246
[167193.154445] RAX: 0000000000000000 RBX: ffffffffffffffea RCX:
0000000000000176
[167193.154523] RDX: 0000000000000000 RSI: 000000008040ae9f RDI:
ffff880075eebe80
[167193.154601] RBP: ffff88005ff33e00 R08: 0000000000000000 R09:
0000000000000000
[167193.154684] R10: 0000000000000000 R11: 0000000000000212 R12:
0000000020010fef
[167193.154785] R13: 0000000000000000 R14: ffff880075eebe80 R15:
0000000000000000
[167193.154864] FS:  00007f00c9d7b700(0000) GS:ffff88007dcc0000(0000)
knlGS:0000000000000000
[167193.154945] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[167193.154994] CR2: 00000000000000f0 CR3: 0000000078982000 CR4:
00000000000406e0
[167193.155077] Stack:
[167193.155112]  ffffffff810e9ca1 0000000000000086 0000000050045e40
0000000000000003
[167193.155199]  ffff880000105200 0000000000000000 0000000000000000
ffff880000000000
[167193.155286]  ffff88005f000000 ffffffffc0249a63 0000000075eebe80
0000000050045e40
[167193.155373] Call Trace:
[167193.155417]  [<ffffffff810e9ca1>] ? add_timer_on+0xf1/0x160
[167193.155469]  [<ffffffffc0249a63>] ? svm_vcpu_load+0x83/0x110 [kvm_amd]
[167193.155536]  [<ffffffffc0544a8a>] ? kvm_arch_vcpu_load+0x5a/0x220 [kvm]
[167193.155600]  [<ffffffffc0531de7>] kvm_vcpu_ioctl+0xe7/0x5f0 [kvm]
[167193.155653]  [<ffffffff81251952>] ? anon_inode_getfd+0x52/0x80
[167193.155713]  [<ffffffffc0530db0>] ? kvm_dev_ioctl+0x140/0x4a0 [kvm]
[167193.155766]  [<ffffffff8121b108>] do_vfs_ioctl+0x298/0x480
[167193.155815]  [<ffffffff81216e64>] ? putname+0x54/0x60
[167193.155863]  [<ffffffff81206dbf>] ? do_sys_open+0x1bf/0x280
[167193.155913]  [<ffffffff8121b369>] SyS_ioctl+0x79/0x90
[167193.155984]  [<ffffffff81811f32>] entry_SYSCALL_64_fastpath+0x16/0x71
[167193.156035] Code: e0 01 83 e2 01 88 95 68 ff ff ff 41 0f b6 96 39
32 00 00 88 85 6a ff ff ff 88 95 69 ff ff ff 0f 1f 44 00 00 49 8b 86
a0 02 00 00 <48> 8b 80 f0 00 00 00 83 e0 01 88 85 6b ff ff ff c7 85 64
ff ff
[167193.156326] RIP  [<ffffffffc0545067>] kvm_arch_vcpu_ioctl+0x417/0x1120 [kvm]
[167193.156391]  RSP <ffff88005ff33d28>
[167193.156432] CR2: 00000000000000f0
[167193.156840] ---[ end trace 3ff15297044194ff ]---


====
// autogenerated by syzkaller (http://github.com/google/syzkaller)
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <stdint.h>
#include <pthread.h>

long r[6];

int main()
{
memset(r, -1, sizeof(r));
r[0] = syscall(SYS_mmap, 0x20000000ul, 0x13000ul, 0x3ul, 0x32ul,
0xfffffffffffffffful, 0x0ul);
memcpy((void*)0x2000eedb, "\x2f\x64\x65\x76\x2f\x6b\x76\x6d", 8);
r[2] = syscall(SYS_open, 0x2000eedbul, 0x0ul, 0x100ul, 0, 0, 0);
r[3] = syscall(SYS_ioctl, r[2], 0xae01ul, 0x0ul, 0, 0, 0);
r[4] = syscall(SYS_ioctl, r[3], 0xae41ul, 0x7ul, 0, 0, 0);
r[5] = syscall(SYS_ioctl, r[4], 0x8040ae9ful, 0x20010feful, 0, 0, 0);
return 0;
}
====

strace:

open("/dev/kvm", O_RDONLY)              = 3
ioctl(3, KVM_CREATE_VM, 0)              = 4
ioctl(4, KVM_CREATE_VCPU, 0x7)          = 5
ioctl(5, KVM_GET_PIT2 or KVM_GET_VCPU_EVENTS, 0x20010fef) = 0

Should be run in parallel (try increasing 10 to 100 or so, if this doesn't work)

$ for x in `seq 1 10`; do { ./prog & }; done

-- 
Robert Święcki