linux-kernel - Re: [PATCH] media: dvb-core: Fix UAF due to refcount races at releasing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20221116131928.GA7144@ubuntu>
Date:   Wed, 16 Nov 2022 05:19:28 -0800
From:   Hyunwoo Kim <imv4bel@...il.com>
To:     Salvatore Bonaccorso <carnil@...ian.org>
Cc:     Takashi Iwai <tiwai@...e.de>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        imv4bel@...il.com
Subject: Re: [PATCH] media: dvb-core: Fix UAF due to refcount races at
 releasing

Hi,

On Wed, Nov 16, 2022 at 12:08:03PM +0100, Salvatore Bonaccorso wrote:
> Hi,
> 
> On Tue, Oct 11, 2022 at 09:06:33AM +0200, Takashi Iwai wrote:
> > On Wed, 21 Sep 2022 09:34:30 +0200,
> > Takashi Iwai wrote:
> > > 
> > > On Thu, 08 Sep 2022 15:27:54 +0200,
> > > Takashi Iwai wrote:
> > > > 
> > > > The dvb-core tries to sync the releases of opened files at
> > > > dvb_dmxdev_release() with two refcounts: dvbdev->users and
> > > > dvr_dvbdev->users.  A problem is present in those two syncs: when yet
> > > > another dvb_demux_open() is called during those sync waits,
> > > > dvb_demux_open() continues to process even if the device is being
> > > > closed.  This includes the increment of the former refcount, resulting
> > > > in the leftover refcount after the sync of the latter refcount at
> > > > dvb_dmxdev_release().  It ends up with use-after-free, since the
> > > > function believes that all usages were gone and releases the
> > > > resources.
> > > > 
> > > > This patch addresses the problem by adding the check of dmxdev->exit
> > > > flag at dvb_demux_open(), just like dvb_dvr_open() already does.  With
> > > > the exit flag check, the second call of dvb_demux_open() fails, hence
> > > > the further corruption can be avoided.
> > > > 
> > > > Also for avoiding the races of the dmxdev->exit flag reference, this
> > > > patch serializes the dmxdev->exit set up and the sync waits with the
> > > > dmxdev->mutex lock at dvb_dmxdev_release().  Without the mutex lock,
> > > > dvb_demux_open() (or dvb_dvr_open()) may run concurrently with
> > > > dvb_dmxdev_release(), which allows to skip the exit flag check and
> > > > continue the open process that is being closed.
> > > > 
> > > > Reported-by: Hyunwoo Kim <imv4bel@...il.com>
> > > > Cc: <stable@...r.kernel.org>
> > > > Signed-off-by: Takashi Iwai <tiwai@...e.de>
> > > 
> > > Any review on this?
> > > 
> > > FWIW, now CVE-2022-41218 is assigned for those bugs as a security
> > > issue.
> > 
> > A gentle ping again.
> > 
> > Or if any other fix for this security issue is already available,
> > please let me know.
> 
> is this correct, the fix is yet missing (or was it fixed by other
> means?).

This patch has been re-send and has been missing for a long time:
https://lore.kernel.org/linux-media/20221031100245.23702-1-tiwai@suse.de/

However, I noticed yesterday that the status of the re-send patch 
changed to 'accpet':
https://patchwork.linuxtv.org/project/linux-media/patch/20221031100245.23702-1-tiwai@suse.de/

But there was no other feedback.


Regards,
Hyunwoo Kim