[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <1441913190.17007.15.camel@decadent.org.uk>
Date: Thu, 10 Sep 2015 20:26:30 +0100
From: Ben Hutchings <ben@...adent.org.uk>
To: oss-security <oss-security@...ts.openwall.com>
Cc: sfjro@...rs.sourceforge.net
Subject: CVE request: Use-after-free in Linux kernel with aufs mmap patch
The aufs (Advanced Union Filesystem) project provides an optional patch
for the Linux kernel, called either aufs3-mmap.patch or
aufs4-mmap.patch, which is needed to ensure correct behaviour of
memory-mapped files from an aufs mount.
Each memory mapping (vma) holds a reference to the file that is mapped.
This patch makes it also hold a reference to the virtual file on the
union mount through which the file was found, where applicable.
In two functions, madvise_remove() and sys_msync(), it is necessary to
take an extra reference to the mapped file before unlocking the current
memory management state, as the vma may be freed after that point.
Unfortunately the aufs patch introduces later uses of the vma, resulting
in a potential use-after-free. This is certainly exploitable for a
minor denial of service (BUG in process context, so the task can't be
cleaned up properly but the system does not panic) but might also be
usable for privilege escalation.
I posted a patch here that works for me:
http://sourceforge.net/p/aufs/mailman/message/34449209/
Please assign a CVE ID to this.
Ben.
--
Ben Hutchings
The most exhausting thing in life is being insincere. - Anne Morrow Lindberg
Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
