[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <CANatu-ZvJwPtHyYKMzpPT7ovMOR=VNYo4kCHnTEtNGpuj3ELHA@mail.gmail.com>
Date: Thu, 30 Nov 2017 02:32:37 +0200
From: Bindecy <contact@...decy.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2017-1000405: Linux kernel - "Dirty COW" variant on transparent
huge pages
Hello,
This is a brief overview of the vulnerability, more details are available
in the post referenced in the GitHub link.
==== Summary ====
In the "Dirty COW" vulnerability patch (CVE-2016-5195),
can_follow_write_pmd() was changed to take into account the new FOLL_COW
flag (8310d48b125d "mm/huge_memory.c: respect FOLL_FORCE/FOLL_COW for thp").
We noticed a problematic use of pmd_mkdirty() in the touch_pmd() function.
touch_pmd() can be reached by get_user_pages(). In such case, the pmd will
become dirty. This scenario breaks the new can_follow_write_pmd()'s logic -
pmd can become dirty without going through a COW cycle - which makes
writing on read-only transparent huge pages possible.
This bug is not as severe as the original "Dirty cow" because an ext4 file
(or any other regular file) cannot be mapped using THP. Nevertheless, it
does allow us to overwrite read-only huge pages. For example, the zero huge
page and sealed shmem files can be overwritten (since their mapping can be
populated using THP). Note that after the first write page-fault to the
zero page, it will be replaced with a new fresh (and zeroed) thp.
Using this primitive, we successfully crashed several processes. A likely
consequence of overwriting the huge zero page is having improper initial
values inside large BSS sections. Common vulnerable pattern would be using
the zero value as an indicator that a global variable hasn't been
initialized yet.
Potentially, privileged processes using the mentioned pattern are
exploitable.
===== POC =====
The POC overwrites the zero-page of the system.
POC source on GitHub: https://github.com/bindecy/HugeDirtyCowPOC
===== Affected Versions =====
The POC was tested on Ubuntu 17.04 with kernel 4.10 and Fedora 27 with
kernel 4.13. Every kernel version with THP support and the Dirty COW patch
should be vulnerable (2.6.38 - 4.14).
RHEL claimed by the vendor as not affected.
Fixed on Nov 27, 2017:
https://github.com/torvalds/linux/commit/a8f97366452ed491d13cf1e44241bc0b5740b1f0
===== Timeline =====
22.11.17 — Initial report to security@...nel.org and
linux-distros@...openwall.org
22.11.17 — CVE-2017–1000405 was assigned
27.11.17 — Patch was committed to mainline kernel
29.11.17 — Public announcement
===== Credit =====
Eylon Ben Yaakov and Daniel Shapiro from Bindecy
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
