linux-kernel - Re: Race 1 in net/xfrm/xfrm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 29 Jul 2022 10:30:31 +0800
From:   Herbert Xu <herbert@...dor.apana.org.au>
To:     Abhishek Shah <abhishek.shah@...umbia.edu>
Cc:     davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org,
        netdev@...r.kernel.org, pabeni@...hat.com,
        steffen.klassert@...unet.com, linux-kernel@...r.kernel.org,
        Gabriel Ryan <gabe@...columbia.edu>,
        Fan Du <fan.du@...driver.com>
Subject: Re: Race 1 in net/xfrm/xfrm_algo.c

On Thu, Jul 28, 2022 at 08:00:00PM -0400, Abhishek Shah wrote:
> Dear Herbert,
> 
> Thanks for your quick reply and sorry for not being more clear about the
> inconsistencies. We identified security implications when algorithms
> disappear or reappear during the execution of *compose_sadb_supported*.
> 
> In more detail,
> 
> 1) If after *xfrm_count_pfkey_auth_supported* has finished counting the
> available algos, a secondary thread changes the availability of an algo
> through *xfrm_probe_algs*, it will return an incorrect number of available
> algorithms. If an algo was added during the racing access, the code
> allocates a buffer that is smaller than the number of available algorithms
> at net/key/af_key.c#L1619
> <https://elixir.bootlin.com/linux/v5.18-rc5/source/net/key/af_key.c#L1619>.
> This will result in an out of bounds write when the buffer is later
> populated at net/key/af_key.c#L1657
> <https://elixir.bootlin.com/linux/v5.18-rc5/source/net/key/af_key.c#L1657>.

OK this is a real bug caused by this commit:

commit 283bc9f35bbbcb0e9ab4e6d2427da7f9f710d52d
Author: Fan Du <fan.du@...driver.com>
Date:   Thu Nov 7 17:47:50 2013 +0800

    xfrm: Namespacify xfrm state/policy locks

It neglected to convert xfrm_probe_algs to namespaces so the
previous assumption of exclusive ownership of xfrm_algo_list
by the current afkey request is no longer true.

Thanks,
-- 
Email: Herbert Xu <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt