linux-kernel - Re: [PATCH 4.14 54/75] af_unix: fix races in sk_peer_pid and sk_peer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 7 Oct 2021 18:21:08 +0200
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Jann Horn <jannh@...gle.com>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Eric Dumazet <edumazet@...gle.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Luiz Augusto von Dentz <luiz.von.dentz@...el.com>,
        Marcel Holtmann <marcel@...tmann.org>,
        "David S. Miller" <davem@...emloft.net>,
        Sasha Levin <sashal@...nel.org>
Subject: Re: [PATCH 4.14 54/75] af_unix: fix races in sk_peer_pid and
 sk_peer_cred accesses

On Thu, Oct 07, 2021 at 05:57:54PM +0200, Jann Horn wrote:
> On Mon, Oct 4, 2021 at 3:00 PM Greg Kroah-Hartman
> <gregkh@...uxfoundation.org> wrote:
> >
> > From: Eric Dumazet <edumazet@...gle.com>
> >
> > [ Upstream commit 35306eb23814444bd4021f8a1c3047d3cb0c8b2b ]
> >
> > Jann Horn reported that SO_PEERCRED and SO_PEERGROUPS implementations
> > are racy, as af_unix can concurrently change sk_peer_pid and sk_peer_cred.
> >
> > In order to fix this issue, this patch adds a new spinlock that needs
> > to be used whenever these fields are read or written.
> >
> > Jann also pointed out that l2cap_sock_get_peer_pid_cb() is currently
> > reading sk->sk_peer_pid which makes no sense, as this field
> > is only possibly set by AF_UNIX sockets.
> > We will have to clean this in a separate patch.
> > This could be done by reverting b48596d1dc25 "Bluetooth: L2CAP: Add get_peer_pid callback"
> > or implementing what was truly expected.
> >
> > Fixes: 109f6e39fa07 ("af_unix: Allow SO_PEERCRED to work across namespaces.")
> 
> >From what I can tell, this fix only went into the stable trees for
> >=4.14? SO_PEERGROUPS only appeared in 4.13, but the SO_PEERCRED in
> 4.4 and 4.9 seems to have exactly the same UAF read as it has on the
> newer kernels.

It doesn't apply cleanly there, can you provide a working backport?

thanks,

greg k-h