| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47126: ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ipv6: Fix KASAN: slab-out-of-bounds Read in fib6_nh_flush_exceptions |
| |
| Reported by syzbot: |
| HEAD commit: 90c911ad Merge tag 'fixes' of git://git.kernel.org/pub/scm.. |
| git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master |
| dashboard link: https://syzkaller.appspot.com/bug?extid=123aa35098fd3c000eb7 |
| compiler: Debian clang version 11.0.1-2 |
| |
| ================================================================== |
| BUG: KASAN: slab-out-of-bounds in fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline] |
| BUG: KASAN: slab-out-of-bounds in fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732 |
| Read of size 8 at addr ffff8880145c78f8 by task syz-executor.4/17760 |
| |
| CPU: 0 PID: 17760 Comm: syz-executor.4 Not tainted 5.12.0-rc8-syzkaller #0 |
| Call Trace: |
| <IRQ> |
| __dump_stack lib/dump_stack.c:79 [inline] |
| dump_stack+0x202/0x31e lib/dump_stack.c:120 |
| print_address_description+0x5f/0x3b0 mm/kasan/report.c:232 |
| __kasan_report mm/kasan/report.c:399 [inline] |
| kasan_report+0x15c/0x200 mm/kasan/report.c:416 |
| fib6_nh_get_excptn_bucket net/ipv6/route.c:1604 [inline] |
| fib6_nh_flush_exceptions+0xbd/0x360 net/ipv6/route.c:1732 |
| fib6_nh_release+0x9a/0x430 net/ipv6/route.c:3536 |
| fib6_info_destroy_rcu+0xcb/0x1c0 net/ipv6/ip6_fib.c:174 |
| rcu_do_batch kernel/rcu/tree.c:2559 [inline] |
| rcu_core+0x8f6/0x1450 kernel/rcu/tree.c:2794 |
| __do_softirq+0x372/0x7a6 kernel/softirq.c:345 |
| invoke_softirq kernel/softirq.c:221 [inline] |
| __irq_exit_rcu+0x22c/0x260 kernel/softirq.c:422 |
| irq_exit_rcu+0x5/0x20 kernel/softirq.c:434 |
| sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1100 |
| </IRQ> |
| asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632 |
| RIP: 0010:lock_acquire+0x1f6/0x720 kernel/locking/lockdep.c:5515 |
| Code: f6 84 24 a1 00 00 00 02 0f 85 8d 02 00 00 f7 c3 00 02 00 00 49 bd 00 00 00 00 00 fc ff df 74 01 fb 48 c7 44 24 40 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 4b c7 44 3d 09 00 00 00 00 43 c7 44 3d |
| RSP: 0018:ffffc90009e06560 EFLAGS: 00000206 |
| RAX: 1ffff920013c0cc0 RBX: 0000000000000246 RCX: dffffc0000000000 |
| RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 |
| RBP: ffffc90009e066e0 R08: dffffc0000000000 R09: fffffbfff1f992b1 |
| R10: fffffbfff1f992b1 R11: 0000000000000000 R12: 0000000000000000 |
| R13: dffffc0000000000 R14: 0000000000000000 R15: 1ffff920013c0cb4 |
| rcu_lock_acquire+0x2a/0x30 include/linux/rcupdate.h:267 |
| rcu_read_lock include/linux/rcupdate.h:656 [inline] |
| ext4_get_group_info+0xea/0x340 fs/ext4/ext4.h:3231 |
| ext4_mb_prefetch+0x123/0x5d0 fs/ext4/mballoc.c:2212 |
| ext4_mb_regular_allocator+0x8a5/0x28f0 fs/ext4/mballoc.c:2379 |
| ext4_mb_new_blocks+0xc6e/0x24f0 fs/ext4/mballoc.c:4982 |
| ext4_ext_map_blocks+0x2be3/0x7210 fs/ext4/extents.c:4238 |
| ext4_map_blocks+0xab3/0x1cb0 fs/ext4/inode.c:638 |
| ext4_getblk+0x187/0x6c0 fs/ext4/inode.c:848 |
| ext4_bread+0x2a/0x1c0 fs/ext4/inode.c:900 |
| ext4_append+0x1a4/0x360 fs/ext4/namei.c:67 |
| ext4_init_new_dir+0x337/0xa10 fs/ext4/namei.c:2768 |
| ext4_mkdir+0x4b8/0xc00 fs/ext4/namei.c:2814 |
| vfs_mkdir+0x45b/0x640 fs/namei.c:3819 |
| ovl_do_mkdir fs/overlayfs/overlayfs.h:161 [inline] |
| ovl_mkdir_real+0x53/0x1a0 fs/overlayfs/dir.c:146 |
| ovl_create_real+0x280/0x490 fs/overlayfs/dir.c:193 |
| ovl_workdir_create+0x425/0x600 fs/overlayfs/super.c:788 |
| ovl_make_workdir+0xed/0x1140 fs/overlayfs/super.c:1355 |
| ovl_get_workdir fs/overlayfs/super.c:1492 [inline] |
| ovl_fill_super+0x39ee/0x5370 fs/overlayfs/super.c:2035 |
| mount_nodev+0x52/0xe0 fs/super.c:1413 |
| legacy_get_tree+0xea/0x180 fs/fs_context.c:592 |
| vfs_get_tree+0x86/0x270 fs/super.c:1497 |
| do_new_mount fs/namespace.c:2903 [inline] |
| path_mount+0x196f/0x2be0 fs/namespace.c:3233 |
| do_mount fs/namespace.c:3246 [inline] |
| __do_sys_mount fs/namespace.c:3454 [inline] |
| __se_sys_mount+0x2f9/0x3b0 fs/namespace.c:3431 |
| do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 |
| entry_SYSCALL_64_after_hwframe+0x44/0xae |
| RIP: 0033:0x4665f9 |
| Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 |
| RSP: 002b:00007f68f2b87188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 |
| RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 00000000004665f9 |
| RDX: 00000000200000c0 RSI: 0000000020000000 RDI: 000000000040000a |
| RBP: 00000000004bfbb9 R08: 0000000020000100 R09: 0000000000000000 |
| R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60 |
| R13: 00007ffe19002dff R14: 00007f68f2b87300 R15: 0000000000022000 |
| |
| Allocated by task 17768: |
| kasan_save_stack mm/kasan/common.c:38 [inline] |
| kasan_set_track mm/kasan/common.c:46 [inline] |
| set_alloc_info mm/kasan/common.c:427 [inline] |
| ____kasan_kmalloc+0xc2/0xf0 mm/kasan/common.c:506 |
| kasan_kmalloc include/linux/kasan.h:233 [inline] |
| __kmalloc+0xb4/0x380 mm/slub.c:4055 |
| kmalloc include/linux/slab.h:559 [inline] |
| kzalloc include/linux/slab.h:684 [inline] |
| fib6_info_alloc+0x2c/0xd0 net/ipv6/ip6_fib.c:154 |
| ip6_route_info_create+0x55d/0x1a10 net/ipv6/route.c:3638 |
| ip6_route_add+0x22/0x120 net/ipv6/route.c:3728 |
| inet6_rtm_newroute+0x2cd/0x2260 net/ipv6/route.c:5352 |
| rtnetlink_rcv_msg+0xb34/0xe70 net/core/rtnetlink.c:5553 |
| netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2502 |
| netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] |
| netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1338 |
| netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1927 |
| sock_sendmsg_nosec net/socket.c:654 [inline] |
| sock_sendmsg net/socket.c:674 [inline] |
| ____sys_sendmsg+0x5a2/0x900 net/socket.c:2350 |
| ___sys_sendmsg net/socket.c:2404 [inline] |
| __sys_sendmsg+0x319/0x400 net/socket.c:2433 |
| do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 |
| entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| Last potentially related work creation: |
| kasan_save_stack+0x27/0x50 mm/kasan/common.c:38 |
| kasan_record_aux_stack+0xee/0x120 mm/kasan/generic.c:345 |
| __call_rcu kernel/rcu/tree.c:3039 [inline] |
| call_rcu+0x1b1/0xa30 kernel/rcu/tree.c:3114 |
| fib6_info_release include/net/ip6_fib.h:337 [inline] |
| ip6_route_info_create+0x10c4/0x1a10 net/ipv6/route.c:3718 |
| ip6_route_add+0x22/0x120 net/ipv6/route.c:3728 |
| inet6_rtm_newroute+0x2cd/0x2260 net/ipv6/route.c:5352 |
| rtnetlink_rcv_msg+0xb34/0xe70 net/core/rtnetlink.c:5553 |
| netlink_rcv_skb+0x1f0/0x460 net/netlink/af_netlink.c:2502 |
| netlink_unicast_kernel net/netlink/af_netlink.c:1312 [inline] |
| netlink_unicast+0x7de/0x9b0 net/netlink/af_netlink.c:1338 |
| netlink_sendmsg+0xaa6/0xe90 net/netlink/af_netlink.c:1927 |
| sock_sendmsg_nosec net/socket.c:654 [inline] |
| sock_sendmsg net/socket.c:674 [inline] |
| ____sys_sendmsg+0x5a2/0x900 net/socket.c:2350 |
| ___sys_sendmsg net/socket.c:2404 [inline] |
| __sys_sendmsg+0x319/0x400 net/socket.c:2433 |
| do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 |
| entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| Second to last potentially related work creation: |
| kasan_save_stack+0x27/0x50 mm/kasan/common.c:38 |
| kasan_record_aux_stack+0xee/0x120 mm/kasan/generic.c:345 |
| insert_work+0x54/0x400 kernel/workqueue.c:1331 |
| __queue_work+0x981/0xcc0 kernel/workqueue.c:1497 |
| queue_work_on+0x111/0x200 kernel/workqueue.c:1524 |
| queue_work include/linux/workqueue.h:507 [inline] |
| call_usermodehelper_exec+0x283/0x470 kernel/umh.c:433 |
| kobject_uevent_env+0x1349/0x1730 lib/kobject_uevent.c:617 |
| kvm_uevent_notify_change+0x309/0x3b0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:4809 |
| kvm_destroy_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:877 [inline] |
| kvm_put_kvm+0x9c/0xd10 arch/x86/kvm/../../../virt/kvm/kvm_main.c:920 |
| kvm_vcpu_release+0x53/0x60 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3120 |
| __fput+0x352/0x7b0 fs/file_table.c:280 |
| task_work_run+0x146/0x1c0 kernel/task_work.c:140 |
| tracehook_notify_resume include/linux/tracehook.h:189 [inline] |
| exit_to_user_mode_loop kernel/entry/common.c:174 [inline] |
| exit_to_user_mode_prepare+0x10b/0x1e0 kernel/entry/common.c:208 |
| __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] |
| syscall_exit_to_user_mode+0x26/0x70 kernel/entry/common.c:301 |
| entry_SYSCALL_64_after_hwframe+0x44/0xae |
| |
| The buggy address belongs to the object at ffff8880145c7800 |
| which belongs to the cache kmalloc-192 of size 192 |
| The buggy address is located 56 bytes to the right of |
| 192-byte region [ffff8880145c7800, ffff8880145c78c0) |
| The buggy address belongs to the page: |
| page:ffffea00005171c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x145c7 |
| flags: 0xfff00000000200(slab) |
| raw: 00fff00000000200 ffffea00006474c0 0000000200000002 ffff888010c41a00 |
| raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 |
| page dumped because: kasan: bad access detected |
| |
| Memory state around the buggy address: |
| ffff8880145c7780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc |
| ffff8880145c7800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 |
| >ffff8880145c7880: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc |
| ^ |
| ffff8880145c7900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb |
| ffff8880145c7980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc |
| ================================================================== |
| |
| In the ip6_route_info_create function, in the case that the nh pointer |
| is not NULL, the fib6_nh in fib6_info has not been allocated. |
| Therefore, when trying to free fib6_info in this error case using |
| fib6_info_release, the function will call fib6_info_destroy_rcu, |
| which it will access fib6_nh_release(f6i->fib6_nh); |
| However, f6i->fib6_nh doesn't have any refcount yet given the lack of allocation |
| causing the reported memory issue above. |
| Therefore, releasing the empty pointer directly instead would be the solution. |
| |
| The Linux kernel CVE team has assigned CVE-2021-47126 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.3 with commit f88d8ea67fbdbac7a64bfa6ed9a2ba27bb822f74 and fixed in 5.4.125 with commit 7ba7fa78a92dc410b6f93ed73075ab669c3a0b59 |
| Issue introduced in 5.3 with commit f88d8ea67fbdbac7a64bfa6ed9a2ba27bb822f74 and fixed in 5.10.43 with commit 09870235827451409ff546b073d754a19fd17e2e |
| Issue introduced in 5.3 with commit f88d8ea67fbdbac7a64bfa6ed9a2ba27bb822f74 and fixed in 5.12.10 with commit 0a462e25ef0f7ab305081a08d435bbd1f13c0a94 |
| Issue introduced in 5.3 with commit f88d8ea67fbdbac7a64bfa6ed9a2ba27bb822f74 and fixed in 5.13 with commit 821bbf79fe46a8b1d18aa456e8ed0a3c208c3754 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47126 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/ipv6/route.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/7ba7fa78a92dc410b6f93ed73075ab669c3a0b59 |
| https://git.kernel.org/stable/c/09870235827451409ff546b073d754a19fd17e2e |
| https://git.kernel.org/stable/c/0a462e25ef0f7ab305081a08d435bbd1f13c0a94 |
| https://git.kernel.org/stable/c/821bbf79fe46a8b1d18aa456e8ed0a3c208c3754 |
