linux-kernel - Re: [PATCH bpf-next 2/2] bpftool: Fix UAF in get_delegate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAADnVQKfH6QnLHfsGO_sL10LhTjL+YUWDist2+xGM_PiPjM9Wg@mail.gmail.com>
Date: Tue, 16 Sep 2025 10:07:33 -0700
From: Alexei Starovoitov <alexei.starovoitov@...il.com>
To: Tao Chen <chen.dylane@...ux.dev>
Cc: Quentin Monnet <qmo@...nel.org>, Alexei Starovoitov <ast@...nel.org>, 
	Daniel Borkmann <daniel@...earbox.net>, Andrii Nakryiko <andrii@...nel.org>, 
	Martin KaFai Lau <martin.lau@...ux.dev>, Eduard <eddyz87@...il.com>, Song Liu <song@...nel.org>, 
	Yonghong Song <yonghong.song@...ux.dev>, John Fastabend <john.fastabend@...il.com>, 
	KP Singh <kpsingh@...nel.org>, Stanislav Fomichev <sdf@...ichev.me>, Hao Luo <haoluo@...gle.com>, 
	Jiri Olsa <jolsa@...nel.org>, bpf <bpf@...r.kernel.org>, 
	LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH bpf-next 2/2] bpftool: Fix UAF in get_delegate_value

On Mon, Sep 15, 2025 at 10:42 PM Tao Chen <chen.dylane@...ux.dev> wrote:
>
> The return value ret pointer is pointing opts_copy, but opts_copy
> gets freed in get_delegate_value before return, fix this by strdup
> a new buffer.
>
> Fixes: 2d812311c2b2 ("bpftool: Add bpf_token show")
> Signed-off-by: Tao Chen <chen.dylane@...ux.dev>
> ---
>  tools/bpf/bpftool/token.c | 47 ++++++++++++++++++++++-----------------
>  1 file changed, 27 insertions(+), 20 deletions(-)
>
> diff --git a/tools/bpf/bpftool/token.c b/tools/bpf/bpftool/token.c
> index 82b829e44c8..c47256d8038 100644
> --- a/tools/bpf/bpftool/token.c
> +++ b/tools/bpf/bpftool/token.c
> @@ -28,6 +28,12 @@ static bool has_delegate_options(const char *mnt_ops)
>                strstr(mnt_ops, "delegate_attachs");
>  }
>
> +static void free_delegate_value(char *value)
> +{
> +       if (value)
> +               free(value);
> +}
> +
>  static char *get_delegate_value(const char *opts, const char *key)
>  {
>         char *token, *rest, *ret = NULL;
> @@ -40,7 +46,7 @@ static char *get_delegate_value(const char *opts, const char *key)
>                         token = strtok_r(NULL, ",", &rest)) {
>                 if (strncmp(token, key, strlen(key)) == 0 &&
>                     token[strlen(key)] == '=') {
> -                       ret = token + strlen(key) + 1;
> +                       ret = strdup(token + strlen(key) + 1);

Instead of adding more strdup-s
strdup(mntent->mnt_opts) once per cmd/map/prog and
remove another strdrup/free in print_items_per_line().

pw-bot: cr