| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CANn89i+NLXpzsCCT=aJDji9Bkq34-bMBzu4vuPRnoCdL+VhOdQ@mail.gmail.com>
Date: Tue, 4 Feb 2025 06:19:06 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: YAN KANG <kangyan91@...look.com>
Cc: "David S. Miller" <davem@...emloft.net>, David Ahern <dsahern@...nel.org>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, Simon Horman <horms@...nel.org>,
"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
"syzkaller@...glegroups.com" <syzkaller@...glegroups.com>
Subject: Re: general protection fault in __fib6_drop_pcpu_from [CVE-2024-40905
Incomplete fix]
On Tue, Feb 4, 2025 at 5:27 AM YAN KANG <kangyan91@...look.com> wrote:
>
> Dear developers and maintainers,
>
> I found a new kernel UAF bug titiled "general protection fault in __fib6_drop_pcpu_from" while using modified syzkaller fuzzing tool. I Itested it on the latest Linux upstream version (6.13.0-rc1), and it was able to be triggered many times .
>
>
> After preliminary analysis, I found CVE-2024-40905 vlunerability maybe fixed incomplete.
> https://lore.kernel.org/linux-cve-announce/2024071208-CVE-2024-40905-44f9@gregkh/T/
> I am sure that this security patch is apply to linux 6.13.
>
>
Yes, I have syzbot reports pointing to the issue.
Do you have a fix already ?
I have been waiting, because I think the bug is caused by a per-cpu
data mangling,
not necessarily in network layers.
Unfortunately, KASAN does not have per-cpu data support I think.
> In function __fib6_drop_pcpu_from (/net/ipv6/ip6_fib.c)
> crashing code:
> ppcpu_rt = per_cpu_ptr(fib6_nh->rt6i_pcpu, cpu); //fib6_nh->rt6i_pcpu is dangling
> pcpu_rt = READ_ONCE(*ppcpu_rt); // Crash here
>
> rootcause of concurrent-UAF:
> The crash occurs because fib6_nh->rt6i_pcpu is accessed after being freed.
> The problematic code path appears to be:
> void fib6_nh_release(struct fib6_nh *fib6_nh) (/net/ipv6/route.c)
> {
> ……
> fib6_nh_release_dsts(fib6_nh); //pcpu_rt = xchg(ppcpu_rt, NULL);
> free_percpu(fib6_nh->rt6i_pcpu);
> // MISSING: fib6_nh->rt6i_pcpu = NULL;
>
> After free_percpu() is called, rt6i_pcpu becomes a dangling pointer. Subsequent accesses to it in __fib6_drop_pcpu_from() via per_cpu_ptr() will trigger use-after-free.
>
> If you fix this issue, please add the following tag to the commit:
> Reported-by: yan kang <kangyan91@...look.com>
> Reported-by: yue sun <samsun1006219@...il.com
>
>
> I hope it helps.
> Best regards
> yan kang
>
> Kernel crash log is listed below.
>
> ==================================================================
> crash log
> ==================================================================
> batman_adv: batadv0: Removing interface: batadv_slave_1
> veth1_macvtap: left promiscuous mode
> veth0_macvtap: left promiscuous mode
> veth1_vlan: left promiscuous mode
> veth0_vlan: left promiscuous mode
> Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN NOPTI
> KASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]
> CPU: 0 UID: 0 PID: 11 Comm: kworker/u8:0 Not tainted 6.13.0-rc1-00003-gd4774759e15b-dirty #87
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
> Workqueue: netns cleanup_net
> RIP: 0010:__fib6_drop_pcpu_from.part.0+0x18e/0x570 net/ipv6/ip6_fib.c:980
> Code: c2 48 c1 ea 03 80 3c 2a 00 0f 85 8a 03 00 00 4c 8b 38 4d 85 ff 74 2e e8 80 0c ca f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 7c 03 00 00 49 8b 87 90 00 00 00 48 3b 04 24 0f
> RSP: 0018:ffffc900000defb8 EFLAGS: 00010207
> RAX: 0000000000000012 RBX: 0000000000000000 RCX: 1ffffffff1b0cb7c
> RDX: ffff88801cee2500 RSI: ffffffff89ceb460 RDI: 0000000000000096
> RBP: dffffc0000000000 R08: 0000000000000000 R09: fffffbfff2d8a198
> R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff1b0cc71
> R13: ffff88810669a8c8 R14: ffffed1020cd3524 R15: 0000000000000006
> FS: 0000000000000000(0000) GS:ffff888062800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f6eecc57000 CR3: 0000000024d02000 CR4: 0000000000752ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
> PKRU: 55555554
> Call Trace:
> <TASK>
> __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1023 [inline]
> fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1024 [inline]
> fib6_purge_rt+0x888/0xa80 net/ipv6/ip6_fib.c:1035
> fib6_del_route net/ipv6/ip6_fib.c:1995 [inline]
> fib6_del+0xa63/0x17f0 net/ipv6/ip6_fib.c:2040
> fib6_clean_node+0x3a1/0x5d0 net/ipv6/ip6_fib.c:2202
> fib6_walk_continue+0x450/0x860 net/ipv6/ip6_fib.c:2124
> fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2172
> fib6_clean_tree+0xdb/0x120 net/ipv6/ip6_fib.c:2252
> __fib6_clean_all+0x105/0x2d0 net/ipv6/ip6_fib.c:2268
> rt6_sync_down_dev net/ipv6/route.c:4908 [inline]
> rt6_disable_ip+0x80a/0xa10 net/ipv6/route.c:4913
> addrconf_ifdown.isra.0+0x12e/0x1ba0 net/ipv6/addrconf.c:3877
> addrconf_notify+0x109/0x1a60 net/ipv6/addrconf.c:3800
> notifier_call_chain+0xba/0x450 kernel/notifier.c:85
> call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1996
> call_netdevice_notifiers_extack net/core/dev.c:2034 [inline]
> call_netdevice_notifiers net/core/dev.c:2048 [inline]
> dev_close_many+0x33d/0x690 net/core/dev.c:1589
> unregister_netdevice_many_notify+0x47a/0x1d30 net/core/dev.c:11494
> unregister_netdevice_many net/core/dev.c:11584 [inline]
> default_device_exit_batch+0x740/0x980 net/core/dev.c:12067
> ops_exit_list+0x128/0x180 net/core/net_namespace.c:177
> cleanup_net+0x5b3/0xb60 net/core/net_namespace.c:632
> process_one_work+0x99f/0x1bb0 kernel/workqueue.c:3229
> process_scheduled_works kernel/workqueue.c:3310 [inline]
> worker_thread+0x66e/0xe80 kernel/workqueue.c:3391
> kthread+0x2c7/0x3b0 kernel/kthread.c:389
> ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
> </TASK>
> Modules linked in:
> ---[ end trace 0000000000000000 ]---
> RIP: 0010:__fib6_drop_pcpu_from.part.0+0x18e/0x570 net/ipv6/ip6_fib.c:980
> Code: c2 48 c1 ea 03 80 3c 2a 00 0f 85 8a 03 00 00 4c 8b 38 4d 85 ff 74 2e e8 80 0c ca f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 7c 03 00 00 49 8b 87 90 00 00 00 48 3b 04 24 0f
> RSP: 0018:ffffc900000defb8 EFLAGS: 00010207
> RAX: 0000000000000012 RBX: 0000000000000000 RCX: 1ffffffff1b0cb7c
> RDX: ffff88801cee2500 RSI: ffffffff89ceb460 RDI: 0000000000000096
> RBP: dffffc0000000000 R08: 0000000000000000 R09: fffffbfff2d8a198
> R10: 0000000000000000 R11: 0000000000000000 R12: fffffbfff1b0cc71
> R13: ffff88810669a8c8 R14: ffffed1020cd3524 R15: 0000000000000006
> FS: 0000000000000000(0000) GS:ffff888062800000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: 00007f6eecc57000 CR3: 0000000024d02000 CR4: 0000000000752ef0
> DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
> DR3: 0000000000000000 DR6: 00000000fffe07f0 DR7: 0000000000000400
> PKRU: 55555554
> ----------------
> Code disassembly (best guess), 1 bytes skipped:
> 0: 48 c1 ea 03 shr $0x3,%rdx
> 4: 80 3c 2a 00 cmpb $0x0,(%rdx,%rbp,1)
> 8: 0f 85 8a 03 00 00 jne 0x398
> e: 4c 8b 38 mov (%rax),%r15
> 11: 4d 85 ff test %r15,%r15
> 14: 74 2e je 0x44
> 16: e8 80 0c ca f7 call 0xf7ca0c9b
> 1b: 49 8d bf 90 00 00 00 lea 0x90(%r15),%rdi
> 22: 48 89 f8 mov %rdi,%rax
> 25: 48 c1 e8 03 shr $0x3,%rax
> * 29: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) <-- trapping instruction
> 2d: 0f 85 7c 03 00 00 jne 0x3af
> 33: 49 8b 87 90 00 00 00 mov 0x90(%r15),%rax
> 3a: 48 3b 04 24 cmp (%rsp),%rax
> 3e: 0f .byte 0xf
Powered by blists - more mailing lists