oss-security - Type Confusion in Linux Kernel

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CADW8OBsT3Lhc2GrgQQThG_-sUz5SyExn-XvbLm7q+wGjuHxPqA@mail.gmail.com>
Date: Mon, 9 Jan 2023 15:09:22 -0700
From: Kyle Zeng <zengyhkyle@...il.com>
To: oss-security@...ts.openwall.com
Subject: Type Confusion in Linux Kernel

Hi there,

I recently found a type-confusion vulnerability in the Linux kernel.
Since it interprets random data as pointers, it is potentially
exploitable. According to the fix commit, this bug was introduced in
Linux-2.6.12-rc2 in 2005. I already contacted security@...nel.org and
helped them patch the vulnerability.

# Vulnerability
The vulnerability is caused by accessing classification results before
checking the classification return code in the network scheduler's
code. For example, in the following snippet from `cbq_classify`:
~~~
struct cbq_class *cl;
......
result = tcf_classify(skb, fl, &res, true);
if (!fl || result < 0)
goto fallback;

cl = (void *)res.class;
~~~
It checks `result < 0` before casting `res.class` to `struct cbq_class
*`. However, `result >= 0` does not ensure `res.class` contains valid
results. Specifically, it is possible `result` itself says the packet
is invalid and should be dropped (`TC_ACT_SHOT`) while at the same
time res.class contains invalid data because res.class is a huge union
attribute and can be used for other purposes before it is marked as
`TC_ACT_SHOT`. As a result, it is a type confusion between `struct
cbq_class` and whatever struct that res.class was used as before it is
returned.

# Patch
Two schedulers have the same vulnerable code patterns and the fixes
can be found https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12
and https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a2965c7be0522eaa18808684b7b82b248515511b

This vulnerability does not have a CVE assigned. I'll appreciate it if
anyone on the mailing list can give it a CVE to signify its security
implications.

Best,
Kyle Zeng

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.