oss-security - Re: Re: Linux kernel: linux-block: nbd: use-after-free Read in nbd_queue

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20210201064344.GA21262@suse.de>
Date: Mon, 1 Feb 2021 07:43:44 +0100
From: Marcus Meissner <meissner@...e.de>
To: oss-security@...ts.openwall.com
Subject: Re: Re: Linux kernel: linux-block: nbd:
 use-after-free Read in nbd_queue_rq

Hi,

Mitre has assigned CVE-2021-3348 to this issue.

Ciao, Marcus
On Sat, Jan 30, 2021 at 04:46:30PM +0800, butt3rflyh4ck wrote:
> the patch for this issue in upstream:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b98e762e3d71e893b221f871825dc64694cfb258
> 
> Regards,
>  butt3rflyh4ck.
> 
> 
> On Fri, Jan 29, 2021 at 2:10 AM butt3rflyh4ck <butterflyhuangxx@...il.com>
> wrote:
> 
> > Hi, I reported a use-after-free Read bug in ndb_queue_rq() in
> > drivers/block/nbd.c and reproduced in linux-5.11.0-rc4+ too.
> >
> > Root Cause:
> >
> > There is a race condition in nbd ioctl.
> > NBD_SET_SIZE_BLOCKS ioctl will call nbd_size_set(), it will change the
> > block size.
> > NBD_SET_SOCK ioctl will call nbd_add_socket() and it will invoke
> > krealloc() to update a block, free and realloc a new one.
> > But nbd_queue_rq() is in runtime. and calls nbd_handle_cmd(), there
> > will use config->sock. there accesses to config->socks without any locking.
> >
> > Patch for this issue:
> >
> > https://lore.kernel.org/linux-block/24dff677353e2e30a71d8b66c4dffdbdf77c4dbd.1611595239.git.josef@toxicpanda.com/
> >
> > CVE assigned:
> > not assigned.
> >
> > Timeline:
> > *2021/1/25  - Vulnerability reported to security@...nel.org.
> > *2020/1/26  - Vulnerability confirmed and patched.
> > *2020/1/28 - Vulnerability reported to linux-distros@...openwall.org.
> > *2021/1/29 - Opened on oss-security@...ts.openwall.com.
> >
> > Credit:
> > This issue was discovered by the ADLab of venustech.
> >
> >
> > Regards,
> >  butt3rflyh4ck.
> >

-- 
Marcus Meissner, Project Manager Security
SUSE Software Solutions Germany GmbH, Maxfeldstr. 5, 90409 Nuernberg, Germany,
GF: Felix Imendoerffer, HRB 36809, AG Nuernberg

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.