netdev - [BUG] Possible Use-After-Free Vulnerability in ether3 Driver Due to Race Condition

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <tencent_48E7914150CBB05A03CD68C4@qq.com>
Date: Mon, 2 Sep 2024 19:42:55 +0800
From: "Wentai Deng" <wtdeng24@...udan.edu.cn>
To: "linux" <linux@...linux.org.uk>
Cc: "davem" <davem@...emloft.net>, "edumazet" <edumazet@...gle.com>, "kuba" <kuba@...nel.org>, "pabeni" <pabeni@...hat.com>, "linux-arm-kernel" <linux-arm-kernel@...ts.infradead.org>, "netdev" <netdev@...r.kernel.org>, "linux-kernel" <linux-kernel@...r.kernel.org>, "杜雪盈" <21210240012@...udan.edu.cn>
Subject: [BUG] Possible Use-After-Free Vulnerability in ether3 Driver Due to Race Condition

Our team recently developed a vulnerability detection tool, and we have employed it to scan the Linux Kernel (version 6.9.6). After manual review, we found some potentially vulnerable code snippets which may have use-after-free bugs due to race conditions. Therefore, we would appreciate your expert insight to confirm whether these vulnerabilities could indeed pose a risk to the system.

Vulnerability Description:

File: /drivers/net/ethernet/seeq/ether3.c

In the ether3_probe function, a timer is initialized with a callback function ether3_ledoff, bound to &prev(dev)->timer. Once the timer is started, there is a risk of a race condition if the module or device is removed, triggering the ether3_remove function to perform cleanup. The sequence of operations that may lead to a UAF bug is as follows:

CPU0                            CPU1

                            |   ether3_ledoff
ether3_remove               |
    free_netdev(dev);       |
    put_device              |
    kfree(dev);             |
                            |       ether3_outw(priv(dev)->regs.config2 |= CFG2_CTRLO, REG_CONFIG2);
                            |       // use dev

Proposed Fix:

The issue can be resolved by ensuring that the timer is canceled before proceeding with the cleanup in ether3_remove or ether3_close. This will prevent any pending or active timer functions from accessing memory that has already been freed.

Relevant CVE and Reference:

This issue is similar to the vulnerability documented in CVE-2023-3141, and a related fix was implemented as shown in the following commit:

memstick: r592: Fix UAF bug in r592_remove due to race condition (https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=63264422785021704c39b38f65a78ab9e4a186d7)

Request for Review:

We would appreciate your expert insight to confirm whether this vulnerability indeed poses a risk to the system and if the proposed fix is appropriate.

Thank you for your time and consideration.

Best regards,
Wentai Deng
wtdeng24@...udan.edu.cn