cve/published/2023/CVE-2023-53023.mbox - pub/scm/linux/security/vulns - Git at Google

 From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
 From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 To: <linux-cve-announce@vger.kernel.org>
 Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
 Subject: CVE-2023-53023: net: nfc: Fix use-after-free in local_cleanup()

 Description
 ===========

 In the Linux kernel, the following vulnerability has been resolved:

 net: nfc: Fix use-after-free in local_cleanup()

 Fix a use-after-free that occurs in kfree_skb() called from
 local_cleanup(). This could happen when killing nfc daemon (e.g. neard)
 after detaching an nfc device.
 When detaching an nfc device, local_cleanup() called from
 nfc_llcp_unregister_device() frees local->rx_pending and decreases
 local->ref by kref_put() in nfc_llcp_local_put().
 In the terminating process, nfc daemon releases all sockets and it leads
 to decreasing local->ref. After the last release of local->ref,
 local_cleanup() called from local_release() frees local->rx_pending
 again, which leads to the bug.

 Setting local->rx_pending to NULL in local_cleanup() could prevent
 use-after-free when local_cleanup() is called twice.

 Found by a modified version of syzkaller.

 BUG: KASAN: use-after-free in kfree_skb()

 Call Trace:
 dump_stack_lvl (lib/dump_stack.c:106)
 print_address_description.constprop.0.cold (mm/kasan/report.c:306)
 kasan_check_range (mm/kasan/generic.c:189)
 kfree_skb (net/core/skbuff.c:955)
 local_cleanup (net/nfc/llcp_core.c:159)
 nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172)
 nfc_llcp_local_put (net/nfc/llcp_core.c:181)
 llcp_sock_destruct (net/nfc/llcp_sock.c:959)
 __sk_destruct (net/core/sock.c:2133)
 sk_destruct (net/core/sock.c:2181)
 __sk_free (net/core/sock.c:2192)
 sk_free (net/core/sock.c:2203)
 llcp_sock_release (net/nfc/llcp_sock.c:646)
 __sock_release (net/socket.c:650)
 sock_close (net/socket.c:1365)
 __fput (fs/file_table.c:306)
 task_work_run (kernel/task_work.c:179)
 ptrace_notify (kernel/signal.c:2354)
 syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278)
 syscall_exit_to_user_mode (kernel/entry/common.c:296)
 do_syscall_64 (arch/x86/entry/common.c:86)
 entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106)

 Allocated by task 4719:
 kasan_save_stack (mm/kasan/common.c:45)
 __kasan_slab_alloc (mm/kasan/common.c:325)
 slab_post_alloc_hook (mm/slab.h:766)
 kmem_cache_alloc_node (mm/slub.c:3497)
 __alloc_skb (net/core/skbuff.c:552)
 pn533_recv_response (drivers/nfc/pn533/usb.c:65)
 __usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671)
 usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704)
 tasklet_action_common.isra.0 (kernel/softirq.c:797)
 __do_softirq (kernel/softirq.c:571)

 Freed by task 1901:
 kasan_save_stack (mm/kasan/common.c:45)
 kasan_set_track (mm/kasan/common.c:52)
 kasan_save_free_info (mm/kasan/genericdd.c:518)
 __kasan_slab_free (mm/kasan/common.c:236)
 kmem_cache_free (mm/slub.c:3809)
 kfree_skbmem (net/core/skbuff.c:874)
 kfree_skb (net/core/skbuff.c:931)
 local_cleanup (net/nfc/llcp_core.c:159)
 nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617)
 nfc_unregister_device (net/nfc/core.c:1179)
 pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846)
 pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579)
 usb_unbind_interface (drivers/usb/core/driver.c:458)
 device_release_driver_internal (drivers/base/dd.c:1279)
 bus_remove_device (drivers/base/bus.c:529)
 device_del (drivers/base/core.c:3665)
 usb_disable_device (drivers/usb/core/message.c:1420)
 usb_disconnect (drivers/usb/core.c:2261)
 hub_event (drivers/usb/core/hub.c:5833)
 process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281)
 worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423)
 kthread (kernel/kthread.c:319)
 ret_from_fork (arch/x86/entry/entry_64.S:301)

 The Linux kernel CVE team has assigned CVE-2023-53023 to this issue.


 Affected and fixed versions
 ===========================

 	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 4.14.305 with commit b09ae26f08aaf2d85f96ea7f90ddd3387f62216f
 	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 4.19.272 with commit 54f7be61584b8ec4c6df405f479495b9397bae4a
 	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 5.4.231 with commit a59cdbda3714e11aa3ab579132864c4c8c6d54f9
 	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 5.10.166 with commit ad1baab3a5c03692d22ce446f38596a126377f6a
 	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 5.15.91 with commit 7f129927feaf7c10b1c38bbce630172e9a08c834
 	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 6.1.9 with commit d3605282ec3502ec8847915eb2cf1f340493ff79
 	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 6.2 with commit 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6

 Please see https://www.kernel.org for a full list of currently supported
 kernel versions by the kernel community.

 Unaffected versions might change over time as fixes are backported to
 older supported kernel versions.  The official CVE entry at
 	https://cve.org/CVERecord/?id=CVE-2023-53023
 will be updated if fixes are backported, please check that for the most
 up to date information about this issue.


 Affected files
 ==============

 The file(s) affected by this issue are:
 	net/nfc/llcp_core.c


 Mitigation
 ==========

 The Linux kernel CVE team recommends that you update to the latest
 stable kernel version for this, and many other bugfixes.  Individual
 changes are never tested alone, but rather are part of a larger kernel
 release.  Cherry-picking individual commits is not recommended or
 supported by the Linux kernel community at all.  If however, updating to
 the latest release is impossible, the individual changes to resolve this
 issue can be found at these commits:
 	https://git.kernel.org/stable/c/b09ae26f08aaf2d85f96ea7f90ddd3387f62216f
 	https://git.kernel.org/stable/c/54f7be61584b8ec4c6df405f479495b9397bae4a
 	https://git.kernel.org/stable/c/a59cdbda3714e11aa3ab579132864c4c8c6d54f9
 	https://git.kernel.org/stable/c/ad1baab3a5c03692d22ce446f38596a126377f6a
 	https://git.kernel.org/stable/c/7f129927feaf7c10b1c38bbce630172e9a08c834
 	https://git.kernel.org/stable/c/d3605282ec3502ec8847915eb2cf1f340493ff79
 	https://git.kernel.org/stable/c/4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6
	From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
	From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
	To: <linux-cve-announce@vger.kernel.org>
	Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
	Subject: CVE-2023-53023: net: nfc: Fix use-after-free in local_cleanup()

	Description
	===========

	In the Linux kernel, the following vulnerability has been resolved:

	net: nfc: Fix use-after-free in local_cleanup()

	Fix a use-after-free that occurs in kfree_skb() called from
	local_cleanup(). This could happen when killing nfc daemon (e.g. neard)
	after detaching an nfc device.
	When detaching an nfc device, local_cleanup() called from
	nfc_llcp_unregister_device() frees local->rx_pending and decreases
	local->ref by kref_put() in nfc_llcp_local_put().
	In the terminating process, nfc daemon releases all sockets and it leads
	to decreasing local->ref. After the last release of local->ref,
	local_cleanup() called from local_release() frees local->rx_pending
	again, which leads to the bug.

	Setting local->rx_pending to NULL in local_cleanup() could prevent
	use-after-free when local_cleanup() is called twice.

	Found by a modified version of syzkaller.

	BUG: KASAN: use-after-free in kfree_skb()

	Call Trace:
	dump_stack_lvl (lib/dump_stack.c:106)
	print_address_description.constprop.0.cold (mm/kasan/report.c:306)
	kasan_check_range (mm/kasan/generic.c:189)
	kfree_skb (net/core/skbuff.c:955)
	local_cleanup (net/nfc/llcp_core.c:159)
	nfc_llcp_local_put.part.0 (net/nfc/llcp_core.c:172)
	nfc_llcp_local_put (net/nfc/llcp_core.c:181)
	llcp_sock_destruct (net/nfc/llcp_sock.c:959)
	__sk_destruct (net/core/sock.c:2133)
	sk_destruct (net/core/sock.c:2181)
	__sk_free (net/core/sock.c:2192)
	sk_free (net/core/sock.c:2203)
	llcp_sock_release (net/nfc/llcp_sock.c:646)
	__sock_release (net/socket.c:650)
	sock_close (net/socket.c:1365)
	__fput (fs/file_table.c:306)
	task_work_run (kernel/task_work.c:179)
	ptrace_notify (kernel/signal.c:2354)
	syscall_exit_to_user_mode_prepare (kernel/entry/common.c:278)
	syscall_exit_to_user_mode (kernel/entry/common.c:296)
	do_syscall_64 (arch/x86/entry/common.c:86)
	entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:106)

	Allocated by task 4719:
	kasan_save_stack (mm/kasan/common.c:45)
	__kasan_slab_alloc (mm/kasan/common.c:325)
	slab_post_alloc_hook (mm/slab.h:766)
	kmem_cache_alloc_node (mm/slub.c:3497)
	__alloc_skb (net/core/skbuff.c:552)
	pn533_recv_response (drivers/nfc/pn533/usb.c:65)
	__usb_hcd_giveback_urb (drivers/usb/core/hcd.c:1671)
	usb_giveback_urb_bh (drivers/usb/core/hcd.c:1704)
	tasklet_action_common.isra.0 (kernel/softirq.c:797)
	__do_softirq (kernel/softirq.c:571)

	Freed by task 1901:
	kasan_save_stack (mm/kasan/common.c:45)
	kasan_set_track (mm/kasan/common.c:52)
	kasan_save_free_info (mm/kasan/genericdd.c:518)
	__kasan_slab_free (mm/kasan/common.c:236)
	kmem_cache_free (mm/slub.c:3809)
	kfree_skbmem (net/core/skbuff.c:874)
	kfree_skb (net/core/skbuff.c:931)
	local_cleanup (net/nfc/llcp_core.c:159)
	nfc_llcp_unregister_device (net/nfc/llcp_core.c:1617)
	nfc_unregister_device (net/nfc/core.c:1179)
	pn53x_unregister_nfc (drivers/nfc/pn533/pn533.c:2846)
	pn533_usb_disconnect (drivers/nfc/pn533/usb.c:579)
	usb_unbind_interface (drivers/usb/core/driver.c:458)
	device_release_driver_internal (drivers/base/dd.c:1279)
	bus_remove_device (drivers/base/bus.c:529)
	device_del (drivers/base/core.c:3665)
	usb_disable_device (drivers/usb/core/message.c:1420)
	usb_disconnect (drivers/usb/core.c:2261)
	hub_event (drivers/usb/core/hub.c:5833)
	process_one_work (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:212 include/trace/events/workqueue.h:108 kernel/workqueue.c:2281)
	worker_thread (include/linux/list.h:282 kernel/workqueue.c:2423)
	kthread (kernel/kthread.c:319)
	ret_from_fork (arch/x86/entry/entry_64.S:301)

	The Linux kernel CVE team has assigned CVE-2023-53023 to this issue.


	Affected and fixed versions
	===========================

	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 4.14.305 with commit b09ae26f08aaf2d85f96ea7f90ddd3387f62216f
	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 4.19.272 with commit 54f7be61584b8ec4c6df405f479495b9397bae4a
	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 5.4.231 with commit a59cdbda3714e11aa3ab579132864c4c8c6d54f9
	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 5.10.166 with commit ad1baab3a5c03692d22ce446f38596a126377f6a
	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 5.15.91 with commit 7f129927feaf7c10b1c38bbce630172e9a08c834
	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 6.1.9 with commit d3605282ec3502ec8847915eb2cf1f340493ff79
	Issue introduced in 3.9 with commit 3536da06db0baa675f32de608c0a4c0f5ef0e9ff and fixed in 6.2 with commit 4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6

	Please see https://www.kernel.org for a full list of currently supported
	kernel versions by the kernel community.

	Unaffected versions might change over time as fixes are backported to
	older supported kernel versions. The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2023-53023
	will be updated if fixes are backported, please check that for the most
	up to date information about this issue.


	Affected files
	==============

	The file(s) affected by this issue are:
	net/nfc/llcp_core.c


	Mitigation
	==========

	The Linux kernel CVE team recommends that you update to the latest
	stable kernel version for this, and many other bugfixes. Individual
	changes are never tested alone, but rather are part of a larger kernel
	release. Cherry-picking individual commits is not recommended or
	supported by the Linux kernel community at all. If however, updating to
	the latest release is impossible, the individual changes to resolve this
	issue can be found at these commits:
	https://git.kernel.org/stable/c/b09ae26f08aaf2d85f96ea7f90ddd3387f62216f
	https://git.kernel.org/stable/c/54f7be61584b8ec4c6df405f479495b9397bae4a
	https://git.kernel.org/stable/c/a59cdbda3714e11aa3ab579132864c4c8c6d54f9
	https://git.kernel.org/stable/c/ad1baab3a5c03692d22ce446f38596a126377f6a
	https://git.kernel.org/stable/c/7f129927feaf7c10b1c38bbce630172e9a08c834
	https://git.kernel.org/stable/c/d3605282ec3502ec8847915eb2cf1f340493ff79
	https://git.kernel.org/stable/c/4bb4db7f3187c6e3de6b229ffc87cdb30a2d22b6