| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2023-52999: net: fix UaF in netns ops registration error path |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| net: fix UaF in netns ops registration error path |
| |
| If net_assign_generic() fails, the current error path in ops_init() tries |
| to clear the gen pointer slot. Anyway, in such error path, the gen pointer |
| itself has not been modified yet, and the existing and accessed one is |
| smaller than the accessed index, causing an out-of-bounds error: |
| |
| BUG: KASAN: slab-out-of-bounds in ops_init+0x2de/0x320 |
| Write of size 8 at addr ffff888109124978 by task modprobe/1018 |
| |
| CPU: 2 PID: 1018 Comm: modprobe Not tainted 6.2.0-rc2.mptcp_ae5ac65fbed5+ #1641 |
| Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.1-2.fc37 04/01/2014 |
| Call Trace: |
| <TASK> |
| dump_stack_lvl+0x6a/0x9f |
| print_address_description.constprop.0+0x86/0x2b5 |
| print_report+0x11b/0x1fb |
| kasan_report+0x87/0xc0 |
| ops_init+0x2de/0x320 |
| register_pernet_operations+0x2e4/0x750 |
| register_pernet_subsys+0x24/0x40 |
| tcf_register_action+0x9f/0x560 |
| do_one_initcall+0xf9/0x570 |
| do_init_module+0x190/0x650 |
| load_module+0x1fa5/0x23c0 |
| __do_sys_finit_module+0x10d/0x1b0 |
| do_syscall_64+0x58/0x80 |
| entry_SYSCALL_64_after_hwframe+0x72/0xdc |
| RIP: 0033:0x7f42518f778d |
| Code: 00 c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 |
| 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff |
| ff 73 01 c3 48 8b 0d cb 56 2c 00 f7 d8 64 89 01 48 |
| RSP: 002b:00007fff96869688 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 |
| RAX: ffffffffffffffda RBX: 00005568ef7f7c90 RCX: 00007f42518f778d |
| RDX: 0000000000000000 RSI: 00005568ef41d796 RDI: 0000000000000003 |
| RBP: 00005568ef41d796 R08: 0000000000000000 R09: 0000000000000000 |
| R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000000 |
| R13: 00005568ef7f7d30 R14: 0000000000040000 R15: 0000000000000000 |
| </TASK> |
| |
| This change addresses the issue by skipping the gen pointer |
| de-reference in the mentioned error-path. |
| |
| Found by code inspection and verified with explicit error injection |
| on a kasan-enabled kernel. |
| |
| The Linux kernel CVE team has assigned CVE-2023-52999 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 4.19.264 with commit 5a2ea549be94924364f6911227d99be86e8cf34a and fixed in 4.19.272 with commit ad0dfe9bcf0d78e699c7efb64c90ed062dc48bea |
| Issue introduced in 5.4.223 with commit 97ad240fd9aa9214497d14af2b91608e20856cac and fixed in 5.4.231 with commit ddd49cbbd4c1ceb38032018b589b44208e54f55e |
| Issue introduced in 5.10.153 with commit c3edc6e808209aa705185f732e682a370981ced1 and fixed in 5.10.166 with commit d4c008f3b7f7d4ffd311eb2dae5e75b3cbddacd0 |
| Issue introduced in 5.15.77 with commit a1e18acb0246bfb001b08b8b1b830b5ec92a0f13 and fixed in 5.15.91 with commit 66689a72ba73575e76d4f6a8748d3fa2690ec1c4 |
| Issue introduced in 6.1 with commit d266935ac43d57586e311a087510fe6a084af742 and fixed in 6.1.9 with commit 12075708f2e77ee6a9f8bb2cf512c38be3099794 |
| Issue introduced in 6.1 with commit d266935ac43d57586e311a087510fe6a084af742 and fixed in 6.2 with commit 71ab9c3e2253619136c31c89dbb2c69305cc89b1 |
| Issue introduced in 6.0.7 with commit 4a4df5e78712de39d6f90d6a64b5eb48dca03bd5 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2023-52999 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| net/core/net_namespace.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/ad0dfe9bcf0d78e699c7efb64c90ed062dc48bea |
| https://git.kernel.org/stable/c/ddd49cbbd4c1ceb38032018b589b44208e54f55e |
| https://git.kernel.org/stable/c/d4c008f3b7f7d4ffd311eb2dae5e75b3cbddacd0 |
| https://git.kernel.org/stable/c/66689a72ba73575e76d4f6a8748d3fa2690ec1c4 |
| https://git.kernel.org/stable/c/12075708f2e77ee6a9f8bb2cf512c38be3099794 |
| https://git.kernel.org/stable/c/71ab9c3e2253619136c31c89dbb2c69305cc89b1 |
