oss-security - [CVE-2023-42755] Linux kernel wild pointer access <= v6.2

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZRHp39Aa3dOf1y/O@westworld>
Date: Mon, 25 Sep 2023 13:13:19 -0700
From: Kyle Zeng <zengyhkyle@...il.com>
To: oss-security@...ts.openwall.com
Subject: [CVE-2023-42755] Linux kernel wild pointer access <= v6.2

Hi there,

I recently found a bug in the rsvp traffic classifier in the Linux kernel.
This classifier is already retired in the upstream but affects all stable
releases. More specifically, this bug affects v6.1, v5.15, v5.10, v5.4,
v4.19, and v4.14.

The symptom of the bug is that the kernel can be tricked into accessing a
wild pointer, thus crash the kernel.

[Root Cause]
The root cause of the bug is an slab-out-of-bound access, but since the
offset to the original pointer is an `unsigned int` fully controlled by
users, the behaviour is ususally a wild pointer access.

in `rsvp_change`, RSVP_PINFO is passed to the kernel without any checks
~~~
static int rsvp_change(...)
{
        ......
        if (tb[TCA_RSVP_PINFO]) {
                pinfo = nla_data(tb[TCA_RSVP_PINFO]);
                f->spi = pinfo->spi;
                f->tunnelhdr = pinfo->tunnelhdr;
        }
        ......
        if (pinfo) {
                s->dpi = pinfo->dpi;
                s->protocol = pinfo->protocol;
                s->tunnelid = pinfo->tunnelid;
        }
        ......
}
~~~

As a result, later when the classifier actually does the classification
in `rsvp_classify`:
~~~
TC_INDIRECT_SCOPE int RSVP_CLS(struct sk_buff *skb, const struct tcf_proto *tp,
                               struct tcf_result *res)
{
        ......
        *(u32 *)(xprt + s->dpi.offset) ^ s->dpi.key)
        ......
}
~~~
`xprt + s->dpi.offset` becomes a wild pointer and crashes the kernel.

[Severity]
This will cause a local denial-of-service.

[Patch]
The patch is to follow the upstream and retire the rsvp classifier in
all the stable trees.
And it is queued in all the stable trees, but not merged yet.
For example, the patch for v6.1 can be found here:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/diff/queue-6.1/net-sched-retire-rsvp-classifier.patch?id=f75b6fc19b6ec061f59b4e18d72ebb32ceea8587

[Affected Version]
I confirmed that this bug affects v6.2, v6.1, v5.15, v5.10, v5.4,
v4.19, and v4.14.

[Proof-of-Concept]
A PoC file is attached to this email.

[Splash]
A kernel oops splash is attached to this email.

This issue is assigned with CVE-2023-42755.

Best,
Kyle Zeng

View attachment "poc.c" of type "text/x-csrc" (27151 bytes)

View attachment "splash" of type "text/plain" (5006 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.