cve/published/2024/CVE-2024-45025.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-45025: fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE

copy_fd_bitmaps(new, old, count) is expected to copy the first
count/BITS_PER_LONG bits from old->full_fds_bits[] and fill
the rest with zeroes.  What it does is copying enough words
(BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest.
That works fine, *if* all bits past the cutoff point are
clear.  Otherwise we are risking garbage from the last word
we'd copied.

For most of the callers that is true - expand_fdtable() has
count equal to old->max_fds, so there's no open descriptors
past count, let alone fully occupied words in ->open_fds[],
which is what bits in ->full_fds_bits[] correspond to.

The other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds),
which is the smallest multiple of BITS_PER_LONG that covers all
opened descriptors below max_fds.  In the common case (copying on
fork()) max_fds is ~0U, so all opened descriptors will be below
it and we are fine, by the same reasons why the call in expand_fdtable()
is safe.

Unfortunately, there is a case where max_fds is less than that
and where we might, indeed, end up with junk in ->full_fds_bits[] -
close_range(from, to, CLOSE_RANGE_UNSHARE) with
	* descriptor table being currently shared
	* 'to' being above the current capacity of descriptor table
	* 'from' being just under some chunk of opened descriptors.
In that case we end up with observably wrong behaviour - e.g. spawn
a child with CLONE_FILES, get all descriptors in range 0..127 open,
then close_range(64, ~0U, CLOSE_RANGE_UNSHARE) and watch dup(0) ending
up with descriptor #128, despite #64 being observably not open.

The minimally invasive fix would be to deal with that in dup_fd().
If this proves to add measurable overhead, we can go that way, but
let's try to fix copy_fd_bitmaps() first.

* new helper: bitmap_copy_and_expand(to, from, bits_to_copy, size).
* make copy_fd_bitmaps() take the bitmap size in words, rather than
bits; it's 'count' argument is always a multiple of BITS_PER_LONG,
so we are not losing any information, and that way we can use the
same helper for all three bitmaps - compiler will see that count
is a multiple of BITS_PER_LONG for the large ones, so it'll generate
plain memcpy()+memset().

Reproducer added to tools/testing/selftests/core/close_range_test.c

The Linux kernel CVE team has assigned CVE-2024-45025 to this issue.


Affected and fixed versions
===========================

	Fixed in 4.19.321 with commit ee501f827f3db02d4e599afbbc1a7f8b792d05d7
	Fixed in 5.4.283 with commit e807487a1d5fd5d941f26578ae826ca815dbfcd6
	Fixed in 5.10.225 with commit fe5bf14881701119aeeda7cf685f3c226c7380df
	Fixed in 5.15.166 with commit 5053581fe5dfb09b58c65dd8462bf5dea71f41ff
	Fixed in 6.1.107 with commit 8cad3b2b3ab81ca55f37405ffd1315bcc2948058
	Fixed in 6.6.48 with commit dd72ae8b0fce9c0bbe9582b9b50820f0407f8d8a
	Fixed in 6.10.7 with commit c69d18f0ac7060de724511537810f10f29a27958
	Fixed in 6.11 with commit 9a2fa1472083580b6c66bdaf291f591e1170123a

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-45025
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/file.c
	include/linux/bitmap.h
	tools/testing/selftests/core/close_range_test.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ee501f827f3db02d4e599afbbc1a7f8b792d05d7
	https://git.kernel.org/stable/c/e807487a1d5fd5d941f26578ae826ca815dbfcd6
	https://git.kernel.org/stable/c/fe5bf14881701119aeeda7cf685f3c226c7380df
	https://git.kernel.org/stable/c/5053581fe5dfb09b58c65dd8462bf5dea71f41ff
	https://git.kernel.org/stable/c/8cad3b2b3ab81ca55f37405ffd1315bcc2948058
	https://git.kernel.org/stable/c/dd72ae8b0fce9c0bbe9582b9b50820f0407f8d8a
	https://git.kernel.org/stable/c/c69d18f0ac7060de724511537810f10f29a27958
	https://git.kernel.org/stable/c/9a2fa1472083580b6c66bdaf291f591e1170123a