[<prev] [next>] [day] [month] [year] [list]
Message-ID: <CAMhUBj=2rfJDZyO01nDEof8c-bS5Y+tLL0NKJzDXJqTgTTariQ@mail.gmail.com>
Date: Wed, 7 Apr 2021 19:16:07 +0800
From: 马哲宇 <zheyuma97@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE-2021-3483: Linux kernel: a use-after-free bug in nosy driver
Hello,
I found a bug in the latest Linux kernel. The
location of the bug is Linux/drivers/firewire/nosy.c. Nosy is an
IEEE 1394 packet sniffer which is used for protocol analysis and in the
development of IEEE 1394 drivers, applications, or firmware.
For each device, the nosy driver allocates a pcilynx structure. A
use-after-free might happen in the following scenario:
1. Open nosy device for the first time and call ioctl with command
NOSY_IOC_START, then a new client A will be malloced and added to
doubly linked list.
2. Open nosy device for the second time and call ioctl with command
NOSY_IOC_START, then a new client B will be malloced and added to
doubly linked list.
3. Call ioctl with command NOSY_IOC_START for client A, then client A
will be readded to the doubly linked list. Now the doubly linked list
is messed up.
4. Close the first nosy device and nosy_release will be called. In
nosy_release, client A will be unlinked and freed.
5. Close the second nosy device, and client A will be referenced,
resulting in UAF.
The root cause of this bug is that the element in the doubly linked
list is reentered into the list.
Here is the commit to patch this BUG:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=829933ef05a951c8ff140e814656d73e74915faf
Regards,
Zheyu Ma
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
