lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5be1fab4-192d-8327-b541-bb92d53313cc@redhat.com>
Date: Thu, 17 Jul 2025 20:45:00 +0200 (CEST)
From: Mikulas Patocka <mpatocka@...hat.com>
To: Hou Tao <houtao1@...wei.com>
cc: Li Lingfeng <lilingfeng3@...wei.com>, dm-devel@...ts.linux.dev, 
    agk@...hat.com, snitzer@...nel.org, tusharsu@...ux.microsoft.com, 
    colin.i.king@...il.com, linux-kernel@...r.kernel.org, yi.zhang@...wei.com, 
    yangerkun@...wei.com, yukuai3@...wei.com, chengzhihao1@...wei.com, 
    lilingfeng@...weicloud.com
Subject: Re: [PATCH] dm: introduce spinlocks to prevent concurrent usage and
 release of device_metadata and hash



On Thu, 17 Jul 2025, Hou Tao wrote:

> Hi,
> 
> On 7/17/2025 10:07 PM, Li Lingfeng wrote:
> > There is a window between freeing md->ima.active_table.hash and setting
> > md->ima.active_table.hash to NULL in dm_ima_measure_on_device_resume().
> > If dm_ima_measure_on_device_remove() accesses md->ima.active_table.hash
> > concurrently during this window, it could lead to a double free or UAF,
> > as shown below:
> 
> The UAF is a problem. However, I think the order of
> dm_ima_measure_on_device_remove() and dm_ima_measure_on_device_resume is
> bigger problem. Is it possible to order these two invocations properly
> by using suspend_lock ?

That's a good point. The patch just papers over the problem. It will fix 
the UAF warning, but it won't fix the fact that 
dm_ima_measure_on_device_resume can race with 
dm_ima_measure_on_device_remove.

The real fix would be to make sure that dm_ima_measure_* calls are never 
called concurrently on the same table - we should use existing device 
mapper locks for that.

Mikukas


Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ