oss-security - Linux non-security almost non-issue: stack-out-of-bounds Read in profile

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20240629205001.GA12674@openwall.com>
Date: Sat, 29 Jun 2024 22:50:01 +0200
From: Solar Designer <solar@...nwall.com>
To: oss-security@...ts.openwall.com
Subject: Linux non-security almost non-issue: stack-out-of-bounds Read in profile_pc

Hi,

On Friday, we got a report CC'ed to s@k.o and linux-distros (which is a
misuse of linux-distros per the currently published instructions, don't
do that) of what turned out to be not a security issue and already
public.  I am posting about it in here not to make an exception that
we'd need to explain anyway.  Just for consistency and transparency.

The corresponding public report from March is:

https://lore.kernel.org/all/CAK55_s7Xyq=nh97=K=G1sxueOFrJDAvPOJAL4TPTCAYvmxO9_A@mail.gmail.com/

---
BUG: KASAN: stack-out-of-bounds in profile_pc+0x120/0x130
arch/x86/kernel/time.c:42
Read of size 8 at addr ffff888108567cc8 by task syz-executor308/360

CPU: 0 PID: 360 Comm: syz-executor308 Not tainted 6.1.82 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS
1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x4d/0x66 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:284 [inline]
 print_report+0x16c/0x4a3 mm/kasan/report.c:395
 kasan_report+0xb3/0x130 mm/kasan/report.c:495
 profile_pc+0x120/0x130 arch/x86/kernel/time.c:42
---

As Vegard Nossum pointed out:

> Writing to /sys/kernel/profiling requires root, so AFAICT this is only a
> security issue for lockdown in the worst case.

and then it's just a harmless out of bounds read that is only detected
in KASan builds.

Nevertheless, Linus promptly fixed the issue by dropping this code in:

   093d9603b600 ("x86: stop playing stack games in profile_pc()")

Alexander

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.