Message-ID: <CAG48ez14Q0-F8LqsvcNbyR2o6gPW8SHXsm4u5jmD9MpsteM2Tw@mail.gmail.com>
Date:   Mon, 7 Oct 2019 22:49:57 +0200
From:   Jann Horn <jannh@...gle.com>
To:     Todd Kjos <tkjos@...gle.com>, Martijn Coenen <maco@...roid.com>,
        Arve Hjønnevåg <arve@...roid.com>,
        Joel Fernandes <joel@...lfernandes.org>,
        Christian Brauner <christian@...uner.io>
Cc:     "open list:ANDROID DRIVERS" <devel@...verdev.osuosl.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: UAF read in print_binder_transaction_log_entry() on ANDROID_BINDERFS kernels

Hi!

There is a use-after-free read in print_binder_transaction_log_entry()
on ANDROID_BINDERFS kernels because
print_binder_transaction_log_entry() prints the char* e->context_name
as string, and if the transaction occurred on a binder device from
binderfs, e->context_name belongs to the binder device and is freed
when the inode disappears.

Luckily this shouldn't have security implications, since:

a) reading the binder transaction log is already a pretty privileged operation
b) I can't find any actual users of ANDROID_BINDERFS

I guess there are three ways to fix it:
1) Create a new shared global spinlock for binderfs_evict_inode() and
binder_transaction_log_show(), and let binderfs_evict_inode() scan the
transaction log for pointers to its name and replace them with
pointers to a statically-allocated string "{DELETED}" or something
like that.
2) Let the transaction log contain non-reusable device identifiers
instead of name pointers, and let print_binder_transaction_log_entry()
look them up in something like a hashtable.
3) Just copy the name into the transaction log every time.

I'm not sure which one is better, or whether there's a nicer fourth
option, so I'm leaving writing a patch for this to y'all.


Trigger instructions (requires you to have some helpers that can
register a context manager and send some transaction to it):
==============
root@...t:/home/user# mkdir /tmp/binder
root@...t:/home/user# mount -t binder -o stats=global /dev/null /tmp/binder
root@...t:/home/user# ls -l /tmp/binder
total 0
crw------- 1 root root 248, 1 Oct  7 20:34 binder
crw------- 1 root root 248, 0 Oct  7 20:34 binder-control
drwxr-xr-x 3 root root      0 Oct  7 20:34 binder_logs
crw------- 1 root root 248, 2 Oct  7 20:34 hwbinder
crw------- 1 root root 248, 3 Oct  7 20:34 vndbinder
root@...t:/home/user# ln -s /tmp/binder/binder /dev/binder
[run some simple binder demo code to temporarily register a context
manager and send a binder transaction]
root@...t:/home/user# rm /tmp/binder/binder
root@...t:/home/user# cat /tmp/binder/binder_logs/transaction_log
2: call  from 2277:2277 to 2273:0 context @������� node 1 handle 0
size 24:8 ret 0/0 l=0
5: call  from 2273:2273 to 2277:2277 context @������� node 3 handle 1
size 0:0 ret 0/0 l=0
6: reply from 2277:2277 to 2273:2273 context @������� node 0 handle 0
size 4:0 ret 0/0 l=0
7: reply from 2273:2273 to 2277:2277 context @������� node 0 handle 0
size 4:0 ret 0/0 l=0
root@...t:/home/user#
==============

ASAN splat:
[  333.300753] ==================================================================
[  333.303197] BUG: KASAN: use-after-free in string_nocheck+0x9d/0x160
[  333.305081] Read of size 1 at addr ffff8880b0981258 by task cat/2279

[  333.307415] CPU: 1 PID: 2279 Comm: cat Not tainted 5.4.0-rc1+ #513
[  333.309304] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996),
BIOS 1.12.0-1 04/01/2014
[  333.310987] Call Trace:
[  333.312032]  dump_stack+0x7c/0xc0
[  333.312581]  ? string_nocheck+0x9d/0x160
[  333.313157]  print_address_description.constprop.7+0x36/0x50
[  333.314030]  ? string_nocheck+0x9d/0x160
[  333.314603]  ? string_nocheck+0x9d/0x160
[  333.315236]  __kasan_report.cold.10+0x1a/0x35
[  333.315972]  ? string_nocheck+0x9d/0x160
[  333.316545]  kasan_report+0xe/0x20
[  333.317104]  string_nocheck+0x9d/0x160
[  333.317652]  ? widen_string+0x160/0x160
[  333.318270]  ? string_nocheck+0x160/0x160
[  333.318857]  ? unwind_get_return_address+0x2a/0x40
[  333.319636]  ? profile_setup.cold.9+0x96/0x96
[  333.320359]  string+0xb6/0xc0
[  333.320800]  ? hex_string+0x280/0x280
[  333.321398]  vsnprintf+0x20c/0x780
[  333.321898]  ? num_to_str+0x180/0x180
[  333.322503]  ? __kasan_kmalloc.constprop.6+0xc1/0xd0
[  333.323235]  ? vfs_read+0xbc/0x1e0
[  333.323814]  ? ksys_read+0xb5/0x150
[  333.324323]  ? do_syscall_64+0xb9/0x3b0
[  333.324948]  ? entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  333.325756]  seq_vprintf+0x78/0xb0
[  333.326253]  seq_printf+0x96/0xc0
[  333.327132]  ? seq_vprintf+0xb0/0xb0
[  333.327678]  ? match_held_lock+0x2e/0x240
[  333.328450]  binder_transaction_log_show+0x237/0x2d0
[  333.329163]  seq_read+0x266/0x690
[  333.329705]  vfs_read+0xbc/0x1e0
[  333.330178]  ksys_read+0xb5/0x150
[  333.330724]  ? kernel_write+0xb0/0xb0
[  333.331257]  ? trace_hardirqs_off_caller+0x57/0x130
[  333.332045]  ? mark_held_locks+0x29/0xa0
[  333.332678]  ? do_syscall_64+0x6b/0x3b0
[  333.333235]  do_syscall_64+0xb9/0x3b0
[  333.333856]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[  333.334635] RIP: 0033:0x7fbbb95d4461
[  333.335153] Code: fe ff ff 50 48 8d 3d fe d0 09 00 e8 e9 03 02 00
66 0f 1f 84 00 00 00 00 00 48 8d 05 99 62 0d 00 8b 00 85 c0 75 13 31
c0 0f 05 <48> 3d 00 f0 ff ff 77 57 c3 66 0f 1f 44 00 00 41 54 49 89 d4
55 48
[  333.337950] RSP: 002b:00007ffcbe6438e8 EFLAGS: 00000246 ORIG_RAX:
0000000000000000
[  333.339072] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fbbb95d4461
[  333.340157] RDX: 0000000000020000 RSI: 00007fbbb9324000 RDI: 0000000000000003
[  333.341320] RBP: 00007fbbb9324000 R08: 00000000ffffffff R09: 0000000000000000
[  333.342454] R10: fffffffffffffb9c R11: 0000000000000246 R12: 00007fbbb9324000
[  333.343550] R13: 0000000000000003 R14: 0000000000000fff R15: 0000000000020000

[  333.344845] Allocated by task 2259:
[  333.345416]  save_stack+0x19/0x80
[  333.345899]  __kasan_kmalloc.constprop.6+0xc1/0xd0
[  333.346636]  __kmalloc_track_caller+0xf4/0x2e0
[  333.347271]  kmemdup+0x17/0x40
[  333.347796]  binderfs_binder_device_create.isra.6+0x217/0x530
[  333.348674]  binderfs_fill_super+0x486/0x81e
[  333.349309]  mount_nodev+0x41/0xb0
[  333.349860]  legacy_get_tree+0x7b/0xc0
[  333.350398]  vfs_get_tree+0x40/0x130
[  333.350970]  do_mount+0xacb/0xea0
[  333.351449]  ksys_mount+0xb1/0xd0
[  333.352007]  __x64_sys_mount+0x5d/0x70
[  333.352545]  do_syscall_64+0xb9/0x3b0
[  333.353144]  entry_SYSCALL_64_after_hwframe+0x49/0xbe

[  333.354144] Freed by task 2278:
[  333.354598]  save_stack+0x19/0x80
[  333.355135]  __kasan_slab_free+0x12e/0x180
[  333.355734]  kfree+0xe6/0x310
[  333.356234]  binderfs_evict_inode+0xb8/0xd0
[  333.356831]  evict+0x16f/0x290
[  333.358081]  do_unlinkat+0x2f6/0x420
[  333.358593]  do_syscall_64+0xb9/0x3b0
[  333.359176]  entry_SYSCALL_64_after_hwframe+0x49/0xbe

[  333.360196] The buggy address belongs to the object at ffff8880b0981258
                which belongs to the cache kmalloc-8 of size 8
[  333.361991] The buggy address is located 0 bytes inside of
                8-byte region [ffff8880b0981258, ffff8880b0981260)
[  333.363796] The buggy address belongs to the page:
[  333.364538] page:ffffea0002c26040 refcount:1 mapcount:0
mapping:ffff8880b6c03c80 index:0x0
[  333.365765] flags: 0x1fffc0000000200(slab)
[  333.366402] raw: 01fffc0000000200 ffffea0002cb1d80 0000001400000014
ffff8880b6c03c80
[  333.367546] raw: 0000000000000000 0000000000aa00aa 00000001ffffffff
0000000000000000
[  333.369030] page dumped because: kasan: bad access detected

[  333.370095] Memory state around the buggy address:
[  333.370824]  ffff8880b0981100: fc fb fc fc fb fc fc fb fc fc fb fc
fc fb fc fc
[  333.371907]  ffff8880b0981180: fb fc fc fb fc fc fb fc fc fb fc fc
fb fc fc fb
[  333.372969] >ffff8880b0981200: fc fc fb fc fc fb fc fc fb fc fc fb
fc fc fb fc
[  333.374033]                                                     ^
[  333.374884]  ffff8880b0981280: fc fb fc fc fb fc fc fb fc fc fb fc
fc fb fc fc
[  333.375957]  ffff8880b0981300: fb fc fc fb fc fc fb fc fc fb fc fc
fb fc fc fb
[  333.377013] ==================================================================

Powered by blists - more mailing lists