| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <ee757a037f954e479e91e045215729f7@huawei.com>
Date: Thu, 17 Aug 2023 13:40:50 +0000
From: "liubo (D)" <liubo335@...wei.com>
To: "borisp@...dia.com" <borisp@...dia.com>, "john.fastabend@...il.com"
<john.fastabend@...il.com>, "kuba@...nel.org" <kuba@...nel.org>,
"netdev@...r.kernel.org" <netdev@...r.kernel.org>, "aviadye@...dia.com"
<aviadye@...dia.com>, "daniel@...earbox.net" <daniel@...earbox.net>
CC: liaichun <liaichun@...wei.com>, "Yanan (Euler)" <yanan@...wei.com>
Subject: [BUG REPORT] UAF in tls tls_encrypt_done
During the fuzzing test On linux5.10 Kasan, UAF(tls_sw_context_tx) occurs between tls_encrypt_done and tls_encrypt_done:
The vmcore is not saved. According to the call_trace,we guess:
When the tls_set_sw_offload function is called, ctx->push_pending_record is set to tls_sw_push_pending_record. When close sock, the process of tls_sk_proto_close is as follows:
CPU0: | CPU1:
tls_sk_proto_close |
tls_sk_proto_cleanup |
tls_handle_open_record |
ctx->push_pending_record(tls_sw_push_pending_record) |
bpf_exec_tx_verdict |
................ |
tls_do_encryption |
aead_request_set_callback(..., tls_encrypt_done, sk) | .........
| kthread
| .......
| tls_encrypt_done
| ..........
| spin_unlock_bh(&ctx->encrypt_compl_lock);
| if (!ready)
| return;
............... |
if (ctx->tx_conf == TLS_SW) |
tls_sw_free_ctx_tx |
kfree(ctx) | ******(now ctx(tls_sw_context_tx) has been released)*****
| if (!test_and_set_bit(BIT_TX_SCHEDULED, &ctx->tx_bitmask)) ***********UAF*********
Check whether the UAF is caused by the conflict between tls_sk_proto_close and tls_encrypt_done or other problems.
The detailed log is as follows:
BUG: KASAN: use-after-free in instrument_atomic_read_write usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/instrumented.h:101 [inline]
BUG: KASAN: use-after-free in test_and_set_bit usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/asm-generic/bitops/instrumented-atomic.h:70 [inline]
BUG: KASAN: use-after-free in tls_encrypt_done+0x3af/0x570 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_sw.c:493
Write of size 8 at addr ffff88810b762520 by task kworker/2:0/27
CPU: 2 PID: 27 Comm: kworker/2:0 Tainted: G OE 5.10.0-136.12.0.86.h1063.eulerosv2r12.x86_64 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: pencrypt_serial padata_serial_worker Call Trace:
__dump_stack usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/lib/dump_stack.c:77 [inline] dump_stack+0xbe/0xfd usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/lib/dump_stack.c:118
print_address_description.constprop.0+0x19/0x170 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/report.c:382
__kasan_report.cold+0x6c/0x84 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/report.c:542
kasan_report+0x3a/0x50 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/report.c:559
check_memory_region_inline usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/generic.c:187 [inline]
check_memory_region+0xfd/0x1f0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/generic.c:193
instrument_atomic_read_write usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/instrumented.h:101 [inline] test_and_set_bit usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/asm-generic/bitops/instrumented-atomic.h:70 [inline]
tls_encrypt_done+0x3af/0x570 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_sw.c:493
padata_serial_worker+0x25d/0x4c0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/padata.c:383
process_one_work+0x6b6/0xf10 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/workqueue.c:2354
worker_thread+0xdd/0xd80 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/workqueue.c:2500
kthread+0x30a/0x410
kthread+usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kern
kthread+el/kthread.c:313
ret_from_fork+0x22/0x30 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/arch/x86/entry/entry_64.S:299
Allocated by task 2355:
kasan_save_stack+0x1b/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:48
kasan_set_track usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:56 [inline] set_alloc_info usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:498 [inline] __kasan_kmalloc usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:530 [inline]
__kasan_kmalloc.constprop.0+0xf0/0x130 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:501
kmalloc usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/slab.h:563 [inline] kzalloc usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/slab.h:675 [inline]
tls_set_sw_offload+0xfc9/0x1330 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_sw.c:2354
do_tls_setsockopt_conf+0x9d0/0xcd0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_main.c:552
do_tls_setsockopt usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_main.c:602 [inline]
tls_setsockopt+0x151/0x1a0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_main.c:622
__sys_setsockopt+0x230/0x470 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:2133
__do_sys_setsockopt usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:2144 [inline] __se_sys_setsockopt usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:2141 [inline]
__x64_sys_setsockopt+0xbf/0x160 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:2141
do_syscall_64+0x33/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x61/0xc6
Freed by task 2328:
kasan_save_stack+0x1b/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:48
kasan_set_track+0x1c/0x30 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:56
kasan_set_free_info+0x20/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/generic.c:361
__kasan_slab_free.part.0+0x13f/0x1b0 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/kasan/common.c:482
slab_free_hook usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/slub.c:1569 [inline] slab_free_freelist_hook usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/slub.c:1608 [inline] slab_free usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/slub.c:3179 [inline]
kfree+0xcb/0x6c0
kfree+usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/mm/slu
kfree+b.c:4176
tls_sk_proto_close+0x428/0x550 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/tls/tls_main.c:324
inet_release+0x138/0x290 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/ipv4/af_inet.c:441
inet6_release+0x51/0x80 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/ipv6/af_inet6.c:486
__sock_release+0xd7/0x290 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:603
sock_close+0x1a/0x30 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/net/socket.c:1273
__fput+0x34f/0x910 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/fs/file_table.c:290
task_work_run+0xea/0x190 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/task_work.c:161
tracehook_notify_resume usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/./include/linux/tracehook.h:188 [inline]
exit_to_user_mode_loop+0xf1/0x100 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/entry/common.c:172
exit_to_user_mode_prepare+0x7e/0x90 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/entry/common.c:206
syscall_exit_to_user_mode+0x12/0x40 usr/src/kernels/linux-5.10.0-136.12.0.86.h1063.eulerosv2r12/kernel/entry/common.c:281
entry_SYSCALL_64_after_hwframe+0x61/0xc6
Powered by blists - more mailing lists