oss-security - CVE-2023-1076: Linux Kernel: Type Confusion hardcodes tuntap socket UID to root

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAEih1qWNqz23HeSbKN+9=zShNOjnWD1SHbVQT-Mu0qSLsHRADQ@mail.gmail.com>
Date: Wed, 1 Mar 2023 16:13:11 +0100
From: Pietro Borrello <borrello@...g.uniroma1.it>
To: oss-security@...ts.openwall.com
Subject: CVE-2023-1076: Linux Kernel: Type Confusion hardcodes tuntap socket
 UID to root

Hi all,

I am disclosing a type confusion in the initialization of TUN/TAP sockets
which hardcodes their UID to 0, usually the root UID.
sock_init_data() assumes that the `struct socket` passed in input is
contained in a `struct socket_alloc` allocated with sock_alloc().
However, tap_open() and tun_chr_open() pass a `struct socket` embedded
in a `struct tap_queue` and `struct tun_file` respectively, both
allocated with sk_alloc().
This causes a type confusion when issuing a container_of() with
SOCK_INODE() in sock_init_data() which results in assigning a wrong
sk_uid to the `struct sock` in input.

Due to the type confusion, both sockets happen to have their UID set
to 0, i.e. root.
While it will be often correct, as TUN/TAP devices require
CAP_NET_ADMIN, it may not always be the case.
Not sure how widespread is the impact of this, it seems the socket UID
may be used for network filtering and routing, thus TUN/TAP sockets may
be incorrectly managed, potentially bypassing network filters based on UID.
Additionally, it seems the sockets with an incorrect UID may be returned
to the vhost driver when issuing a get_socket() on a TUN/TAP device in
vhost_net_set_backend().

The proposed patches fix the bugs by adding and using sock_init_data_uid(),
which explicitly takes a UID as argument, and have been merged:
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=66b2c338adce580dfce2199591e65e2bab889cff
https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=a096ccca6e503a5c575717ff8a36ace27510ab0a

The issue has been assigned CVE-2023-1076.

Best regards,
Pietro Borrello

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.