linux-kernel - Re: [PATCH] HSI: ssi_protocol: Fix use after free vulnerability in ssi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <C3AD95D8ADEB0624+7db2db3f.acd7.191f183b41f.Coremail.kxwang23@m.fudan.edu.cn>
Date: Sun, 15 Sep 2024 01:10:26 +0800 (CST)
From: "Kaixin Wang" <kxwang23@...udan.edu.cn>
To: "Sebastian Reichel" <sre@...nel.org>
Cc: andriy.shevchenko@...ux.intel.com, rdunlap@...radead.org, 
	linux-kernel@...r.kernel.org, 21210240012@...udan.edu.cn, 
	21302010073@...udan.edu.cn
Subject: Re: [PATCH] HSI: ssi_protocol: Fix use after free vulnerability in
 ssi_protocol Driver Due to Race Condition



At 2024-09-14 15:20:07, "Sebastian Reichel" <sre@...nel.org> wrote:
>Hi,
>
>On Wed, Sep 11, 2024 at 11:19:15PM GMT, Kaixin Wang wrote:
>> In the ssi_protocol_probe function, &ssi->work is bound with
>> ssip_xmit_work, In ssip_pn_setup, the ssip_pn_xmit function
>> within the ssip_pn_ops structure is capable of starting the
>> work.
>> 
>> If we remove the module which will call ssi_protocol_remove
>> to make a cleanup, it will free ssi through kfree(ssi),
>> while the work mentioned above will be used. The sequence
>> of operations that may lead to a UAF bug is as follows:
>> 
>> CPU0                                    CPU1
>> 
>>                         | ssip_xmit_work
>> ssi_protocol_remove     |
>> kfree(ssi);             |
>>                         | struct hsi_client *cl = ssi->cl;
>>                         | // use ssi
>> 
>> Fix it by ensuring that the work is canceled before proceeding
>> with the cleanup in ssi_protocol_remove
>> 
>> Signed-off-by: Kaixin Wang <kxwang23@...udan.edu.cn>
>> ---
>
>This does not even compile :(
>

Sorry for my mistake.

>During module removal the network device is unregistered (and thus
>stopped), which calls ssip_reset(), which should stop any activity
>regarding traffic exchange. That's the right place to cancel the
>work.
>
>Greetings,
>
>-- Sebastian
>

Thanks. I will fix it in the next version.

Best regards,
Kaixin Wang

>>  drivers/hsi/clients/ssi_protocol.c | 1 +
>>  1 file changed, 1 insertion(+)
>> 
>> diff --git a/drivers/hsi/clients/ssi_protocol.c b/drivers/hsi/clients/ssi_protocol.c
>> index afe470f3661c..3506c70e3505 100644
>> --- a/drivers/hsi/clients/ssi_protocol.c
>> +++ b/drivers/hsi/clients/ssi_protocol.c
>> @@ -1155,6 +1155,7 @@ static int ssi_protocol_remove(struct device *dev)
>>  	unregister_netdev(ssi->netdev);
>>  	ssip_free_cmds(ssi);
>>  	hsi_client_set_drvdata(cl, NULL);
>> +	cancel_work_sync(&ssi->work)
>>  	kfree(ssi);
>>  
>>  	return 0;
>> -- 
>> 2.25.1
>> 
>>