cve/published/2024/CVE-2024-26961.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-26961: mac802154: fix llsec key resources release in mac802154_llsec_key_del

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

mac802154: fix llsec key resources release in mac802154_llsec_key_del

mac802154_llsec_key_del() can free resources of a key directly without
following the RCU rules for waiting before the end of a grace period. This
may lead to use-after-free in case llsec_lookup_key() is traversing the
list of keys in parallel with a key deletion:

refcount_t: addition on 0; use-after-free.
WARNING: CPU: 4 PID: 16000 at lib/refcount.c:25 refcount_warn_saturate+0x162/0x2a0
Modules linked in:
CPU: 4 PID: 16000 Comm: wpan-ping Not tainted 6.7.0 #19
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
RIP: 0010:refcount_warn_saturate+0x162/0x2a0
Call Trace:
 <TASK>
 llsec_lookup_key.isra.0+0x890/0x9e0
 mac802154_llsec_encrypt+0x30c/0x9c0
 ieee802154_subif_start_xmit+0x24/0x1e0
 dev_hard_start_xmit+0x13e/0x690
 sch_direct_xmit+0x2ae/0xbc0
 __dev_queue_xmit+0x11dd/0x3c20
 dgram_sendmsg+0x90b/0xd60
 __sys_sendto+0x466/0x4c0
 __x64_sys_sendto+0xe0/0x1c0
 do_syscall_64+0x45/0xf0
 entry_SYSCALL_64_after_hwframe+0x6e/0x76

Also, ieee802154_llsec_key_entry structures are not freed by
mac802154_llsec_key_del():

unreferenced object 0xffff8880613b6980 (size 64):
  comm "iwpan", pid 2176, jiffies 4294761134 (age 60.475s)
  hex dump (first 32 bytes):
    78 0d 8f 18 80 88 ff ff 22 01 00 00 00 00 ad de  x.......".......
    00 00 00 00 00 00 00 00 03 00 cd ab 00 00 00 00  ................
  backtrace:
    [<ffffffff81dcfa62>] __kmem_cache_alloc_node+0x1e2/0x2d0
    [<ffffffff81c43865>] kmalloc_trace+0x25/0xc0
    [<ffffffff88968b09>] mac802154_llsec_key_add+0xac9/0xcf0
    [<ffffffff8896e41a>] ieee802154_add_llsec_key+0x5a/0x80
    [<ffffffff8892adc6>] nl802154_add_llsec_key+0x426/0x5b0
    [<ffffffff86ff293e>] genl_family_rcv_msg_doit+0x1fe/0x2f0
    [<ffffffff86ff46d1>] genl_rcv_msg+0x531/0x7d0
    [<ffffffff86fee7a9>] netlink_rcv_skb+0x169/0x440
    [<ffffffff86ff1d88>] genl_rcv+0x28/0x40
    [<ffffffff86fec15c>] netlink_unicast+0x53c/0x820
    [<ffffffff86fecd8b>] netlink_sendmsg+0x93b/0xe60
    [<ffffffff86b91b35>] ____sys_sendmsg+0xac5/0xca0
    [<ffffffff86b9c3dd>] ___sys_sendmsg+0x11d/0x1c0
    [<ffffffff86b9c65a>] __sys_sendmsg+0xfa/0x1d0
    [<ffffffff88eadbf5>] do_syscall_64+0x45/0xf0
    [<ffffffff890000ea>] entry_SYSCALL_64_after_hwframe+0x6e/0x76

Handle the proper resource release in the RCU callback function
mac802154_llsec_key_del_rcu().

Note that if llsec_lookup_key() finds a key, it gets a refcount via
llsec_key_get() and locally copies key id from key_entry (which is a
list element). So it's safe to call llsec_key_put() and free the list
entry after the RCU grace period elapses.

Found by Linux Verification Center (linuxtesting.org).

The Linux kernel CVE team has assigned CVE-2024-26961 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.16 with commit 5d637d5aabd85132bd85779677d8acb708e0ed90 and fixed in 5.10.215 with commit 068ab2759bc0b4daf0b964de61b2731449c86531
	Issue introduced in 3.16 with commit 5d637d5aabd85132bd85779677d8acb708e0ed90 and fixed in 5.15.154 with commit d3d858650933d44ac12c1f31337e7110c2071821
	Issue introduced in 3.16 with commit 5d637d5aabd85132bd85779677d8acb708e0ed90 and fixed in 6.1.84 with commit dcd51ab42b7a0431575689c5f74b8b6efd45fc2f
	Issue introduced in 3.16 with commit 5d637d5aabd85132bd85779677d8acb708e0ed90 and fixed in 6.6.24 with commit 20d3e1c8a1847497269f04d874b2a5818ec29e2d
	Issue introduced in 3.16 with commit 5d637d5aabd85132bd85779677d8acb708e0ed90 and fixed in 6.7.12 with commit 640297c3e897bd7e1481466a6a5cb9560f1edb88
	Issue introduced in 3.16 with commit 5d637d5aabd85132bd85779677d8acb708e0ed90 and fixed in 6.8.3 with commit 49c8951680d7b76fceaee89dcfbab1363fb24fd1
	Issue introduced in 3.16 with commit 5d637d5aabd85132bd85779677d8acb708e0ed90 and fixed in 6.9 with commit e8a1e58345cf40b7b272e08ac7b32328b2543e40

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-26961
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/cfg802154.h
	net/mac802154/llsec.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/068ab2759bc0b4daf0b964de61b2731449c86531
	https://git.kernel.org/stable/c/d3d858650933d44ac12c1f31337e7110c2071821
	https://git.kernel.org/stable/c/dcd51ab42b7a0431575689c5f74b8b6efd45fc2f
	https://git.kernel.org/stable/c/20d3e1c8a1847497269f04d874b2a5818ec29e2d
	https://git.kernel.org/stable/c/640297c3e897bd7e1481466a6a5cb9560f1edb88
	https://git.kernel.org/stable/c/49c8951680d7b76fceaee89dcfbab1363fb24fd1
	https://git.kernel.org/stable/c/e8a1e58345cf40b7b272e08ac7b32328b2543e40