linux-kernel - [PATCH] aacraid: fix potential double-fetch issue

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 20 Sep 2017 00:08:52 -0400
From:   Meng Xu <mengxu.gatech@...il.com>
To:     aacraid@...rosemi.com, jejb@...ux.vnet.ibm.com,
        martin.petersen@...cle.com, linux-scsi@...r.kernel.org,
        linux-kernel@...r.kernel.org
Cc:     Meng Xu <mengxu.gatech@...il.com>
Subject: [PATCH] aacraid: fix potential double-fetch issue

While examining the kernel source code, I found a dangerous operation
that could turn into a double-fetch situation (a race condition bug)
where the same userspace memory region are fetched twice into kernel
with sanity checks after the first fetch while missing checks after the
second fetch.

1. The first userspace fetch happens in
copy_from_user(&fibsize, &user_srb->count,sizeof(u32))

2. Subsequently fibsize undergoes a few sanity checks and is then
used to allocate user_srbcmd = kmalloc(fibsize, GFP_KERNEL).

3. The second userspace fetch happens in
copy_from_user(user_srbcmd, user_srb,fibsize)

4. Given that the memory region pointed by user_srb can be fully
controlled in userspace, an attacker can race to override the
user_srb->count to arbitrary value (say 0XFFFFFFFF) after the first
fetch but before the second. The changed value will be copied to
user_srbcmd.

The patch explicitly overrides user_srbcmd->count after the second
userspace fetch with the value fibsize from the first userspace fetch.
In this way, it is assured that the relation, user_srbcmd->count stores
the size of the user_srbcmd buffer, still holds after the second fetch.

Signed-off-by: Meng Xu <mengxu.gatech@...il.com>
---
 drivers/scsi/aacraid/commctrl.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/drivers/scsi/aacraid/commctrl.c b/drivers/scsi/aacraid/commctrl.c
index 9ab0fa9..734bf11 100644
--- a/drivers/scsi/aacraid/commctrl.c
+++ b/drivers/scsi/aacraid/commctrl.c
@@ -540,6 +540,12 @@ static int aac_send_raw_srb(struct aac_dev* dev, void __user * arg)
 		goto cleanup;
 	}

+	/* 
+	 * re-establish the relation that user_srbcmd->count holds the 
+	 * size of user_srbcmd 
+	 */
+	user_srbcmd->count = fibsize;
+
 	flags = user_srbcmd->flags; /* from user in cpu order */
 	switch (flags & (SRB_DataIn | SRB_DataOut)) {
 	case SRB_DataOut:
-- 
2.7.4