cve/published/2024/CVE-2024-46738.mbox

From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: <linux-cve-announce@vger.kernel.org>
Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org>
Subject: CVE-2024-46738: VMCI: Fix use-after-free when removing resource in vmci_resource_remove()

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

VMCI: Fix use-after-free when removing resource in vmci_resource_remove()

When removing a resource from vmci_resource_table in
vmci_resource_remove(), the search is performed using the resource
handle by comparing context and resource fields.

It is possible though to create two resources with different types
but same handle (same context and resource fields).

When trying to remove one of the resources, vmci_resource_remove()
may not remove the intended one, but the object will still be freed
as in the case of the datagram type in vmci_datagram_destroy_handle().
vmci_resource_table will still hold a pointer to this freed resource
leading to a use-after-free vulnerability.

BUG: KASAN: use-after-free in vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]
BUG: KASAN: use-after-free in vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147
Read of size 4 at addr ffff88801c16d800 by task syz-executor197/1592
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x82/0xa9 lib/dump_stack.c:106
 print_address_description.constprop.0+0x21/0x366 mm/kasan/report.c:239
 __kasan_report.cold+0x7f/0x132 mm/kasan/report.c:425
 kasan_report+0x38/0x51 mm/kasan/report.c:442
 vmci_handle_is_equal include/linux/vmw_vmci_defs.h:142 [inline]
 vmci_resource_remove+0x3a1/0x410 drivers/misc/vmw_vmci/vmci_resource.c:147
 vmci_qp_broker_detach+0x89a/0x11b9 drivers/misc/vmw_vmci/vmci_queue_pair.c:2182
 ctx_free_ctx+0x473/0xbe1 drivers/misc/vmw_vmci/vmci_context.c:444
 kref_put include/linux/kref.h:65 [inline]
 vmci_ctx_put drivers/misc/vmw_vmci/vmci_context.c:497 [inline]
 vmci_ctx_destroy+0x170/0x1d6 drivers/misc/vmw_vmci/vmci_context.c:195
 vmci_host_close+0x125/0x1ac drivers/misc/vmw_vmci/vmci_host.c:143
 __fput+0x261/0xa34 fs/file_table.c:282
 task_work_run+0xf0/0x194 kernel/task_work.c:164
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop+0x184/0x189 kernel/entry/common.c:187
 exit_to_user_mode_prepare+0x11b/0x123 kernel/entry/common.c:220
 __syscall_exit_to_user_mode_work kernel/entry/common.c:302 [inline]
 syscall_exit_to_user_mode+0x18/0x42 kernel/entry/common.c:313
 do_syscall_64+0x41/0x85 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x6e/0x0

This change ensures the type is also checked when removing
the resource from vmci_resource_table in vmci_resource_remove().

The Linux kernel CVE team has assigned CVE-2024-46738 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.9 with commit bc63dedb7d46a7d690c6b6edf69136b88af06cc6 and fixed in 4.19.322 with commit f6365931bf7c07b2b397dbb06a4f6573cc9fae73
	Issue introduced in 3.9 with commit bc63dedb7d46a7d690c6b6edf69136b88af06cc6 and fixed in 5.4.284 with commit b243d52b5f6f59f9d39e69b191fb3d58b94a43b1
	Issue introduced in 3.9 with commit bc63dedb7d46a7d690c6b6edf69136b88af06cc6 and fixed in 5.10.226 with commit 6c563a29857aa8053b67ee141191f69757f27f6e
	Issue introduced in 3.9 with commit bc63dedb7d46a7d690c6b6edf69136b88af06cc6 and fixed in 5.15.167 with commit ef5f4d0c5ee22d4f873116fec844ff6edaf3fa7d
	Issue introduced in 3.9 with commit bc63dedb7d46a7d690c6b6edf69136b88af06cc6 and fixed in 6.1.110 with commit b9efdf333174468651be40390cbc79c9f55d9cce
	Issue introduced in 3.9 with commit bc63dedb7d46a7d690c6b6edf69136b88af06cc6 and fixed in 6.6.51 with commit 39e7e593418ccdbd151f2925fa6be1a616d16c96
	Issue introduced in 3.9 with commit bc63dedb7d46a7d690c6b6edf69136b88af06cc6 and fixed in 6.10.10 with commit 00fe5292f081f8d773e572df8e03bf6e1855fe49
	Issue introduced in 3.9 with commit bc63dedb7d46a7d690c6b6edf69136b88af06cc6 and fixed in 6.11 with commit 48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2024-46738
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/misc/vmw_vmci/vmci_resource.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f6365931bf7c07b2b397dbb06a4f6573cc9fae73
	https://git.kernel.org/stable/c/b243d52b5f6f59f9d39e69b191fb3d58b94a43b1
	https://git.kernel.org/stable/c/6c563a29857aa8053b67ee141191f69757f27f6e
	https://git.kernel.org/stable/c/ef5f4d0c5ee22d4f873116fec844ff6edaf3fa7d
	https://git.kernel.org/stable/c/b9efdf333174468651be40390cbc79c9f55d9cce
	https://git.kernel.org/stable/c/39e7e593418ccdbd151f2925fa6be1a616d16c96
	https://git.kernel.org/stable/c/00fe5292f081f8d773e572df8e03bf6e1855fe49
	https://git.kernel.org/stable/c/48b9a8dabcc3cf5f961b2ebcd8933bf9204babb7