linux-kernel - Re: [PATCH] hci: fix double free in hci_req

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <e1ea75d7-b59e-41e7-9a3b-bd63615a9d0c@gmail.com>
Date: Tue, 2 Jul 2024 05:14:19 +0900
From: Yunseong Kim <yskelg@...il.com>
To: Luiz Augusto von Dentz <luiz.dentz@...il.com>
Cc: Marcel Holtmann <marcel@...tmann.org>,
 Johan Hedberg <johan.hedberg@...il.com>, Austin Kim
 <austindh.kim@...il.com>, Yeoreum Yun <ppbuk5246@...il.com>,
 MichelleJin <shjy180909@...il.com>, linux-bluetooth@...r.kernel.org,
 linux-kernel@...r.kernel.org, Levi Yun <yeoreum.yun@....com>
Subject: Re: [PATCH] hci: fix double free in hci_req_sync

Hi Luiz,

On 7/2/24 5:06 오전, Luiz Augusto von Dentz wrote:
> Hi,
> 
> On Mon, Jul 1, 2024 at 3:45 PM Yunseong Kim <yskelg@...il.com> wrote:
>>
>> The approach taken to address the 'CVE-2024-35978' introduced another
>> double-free vulnerability. commit 45d355a926ab
>> ("Bluetooth: Fix memory leak in hci_req_sync_complete()")
>>
>> 'hdev->req_skb' double free scenario:
>>
>>  cpu1                        cpu2
>>  ====                        ====
>>  sock_ioctl
>>  sock_do_ioctl
>>  hci_sock_ioctl
>>  hci_dev_cmd
>>  hci_req_sync
> 
> hci_req_sync is no longer called from hci_dev_cmd:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git/commit/?id=6851d11d389ceb00c1220b267b9a04f54dbc4573
> 
> And I'm in process of removing hci_request.c completely.
> 
>>  __hci_req_sync              hci_rx_work
>>  kfree_skb(hdev->req_skb)    hci_event_packet
>>  (sleep)                     hci_req_sync_complete
>>   \__ Longer times,          kfree_skb(hdev->req_skb)
>>       reproduce well         hdev->req_skb = NULL
>>

Thank you so much your hard work.

I saw the patch email at the link below.
Link:
https://lore.kernel.org/all/a9609dd3d0cb3b8c3fd387efe8a81eddc821be0f.camel@iki.fi/T/

Does the patch you mentioned apply to backports as well?


Warm regards,

Yunseong Kim