|
 |
c38cbc |
From 7d389a33490309d15530e3372c3045110b3031ab Mon Sep 17 00:00:00 2001
|
|
|
c38cbc |
From: Artem Savkov <asavkov@redhat.com>
|
|
|
c38cbc |
Date: Tue, 4 Jan 2022 10:40:56 +0100
|
|
|
c38cbc |
Subject: [KPATCH CVE-2021-4154] cgroup: verify that source is a string
|
|
|
c38cbc |
|
|
|
c38cbc |
Kernels:
|
|
|
c38cbc |
4.18.0-348.el8
|
|
|
c38cbc |
4.18.0-348.2.1.el8_5
|
|
|
c38cbc |
4.18.0-348.7.1.el8_5
|
|
|
c38cbc |
|
|
|
c38cbc |
Changes since last build:
|
|
|
c38cbc |
arches: x86_64 ppc64le
|
|
|
c38cbc |
cgroup-v1.o: changed function: cgroup1_parse_param
|
|
|
c38cbc |
---------------------------
|
|
|
c38cbc |
|
|
|
c38cbc |
Kpatch-MR: https://gitlab.com/redhat/prdsc/rhel/src/kpatch/rhel-8/-/merge_requests/9
|
|
|
c38cbc |
Approved-by: Yannick Cote (@ycote1)
|
|
|
c38cbc |
Approved-by: Joe Lawrence (@joe.lawrence)
|
|
|
c38cbc |
Kernels:
|
|
|
c38cbc |
4.18.0-348.el8
|
|
|
c38cbc |
4.18.0-348.2.1.el8_5
|
|
|
c38cbc |
4.18.0-348.7.1.el8_5
|
|
|
c38cbc |
4.18.0-348.12.2.el8_5
|
|
|
c38cbc |
|
|
|
c38cbc |
Modifications: none
|
|
|
c38cbc |
Z-MR: https://gitlab.com/redhat/rhel/src/kernel/rhel-8/-/merge_requests/1865
|
|
|
c38cbc |
CVE: CVE-2021-4154
|
|
|
c38cbc |
|
|
|
c38cbc |
commit e1ee4bc6e6d8fd36b493fca941b7d5b6e987ae3c
|
|
|
c38cbc |
Author: Waiman Long <longman@redhat.com>
|
|
|
c38cbc |
Date: Tue Dec 21 09:47:25 2021 -0500
|
|
|
c38cbc |
|
|
|
c38cbc |
cgroup: verify that source is a string
|
|
|
c38cbc |
|
|
|
c38cbc |
Bugzilla: https://bugzilla.redhat.com/2034608
|
|
|
c38cbc |
Y-Commit: b6d2fff23b0eee0e82d128f23c4ebd99a30299c3
|
|
|
c38cbc |
|
|
|
c38cbc |
O-Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=2034609
|
|
|
c38cbc |
|
|
|
c38cbc |
commit 3b0462726e7ef281c35a7a4ae33e93ee2bc9975b
|
|
|
c38cbc |
Author: Christian Brauner <christian.brauner@ubuntu.com>
|
|
|
c38cbc |
Date: Wed, 14 Jul 2021 15:47:49 +0200
|
|
|
c38cbc |
|
|
|
c38cbc |
cgroup: verify that source is a string
|
|
|
c38cbc |
|
|
|
c38cbc |
The following sequence can be used to trigger a UAF:
|
|
|
c38cbc |
|
|
|
c38cbc |
int fscontext_fd = fsopen("cgroup");
|
|
|
c38cbc |
int fd_null = open("/dev/null, O_RDONLY);
|
|
|
c38cbc |
int fsconfig(fscontext_fd, FSCONFIG_SET_FD, "source", fd_null);
|
|
|
c38cbc |
close_range(3, ~0U, 0);
|
|
|
c38cbc |
|
|
|
c38cbc |
The cgroup v1 specific fs parser expects a string for the "source"
|
|
|
c38cbc |
parameter. However, it is perfectly legitimate to e.g. specify a file
|
|
|
c38cbc |
descriptor for the "source" parameter. The fs parser doesn't know what
|
|
|
c38cbc |
a filesystem allows there. So it's a bug to assume that "source" is
|
|
|
c38cbc |
always of type fs_value_is_string when it can reasonably also be
|
|
|
c38cbc |
fs_value_is_file.
|
|
|
c38cbc |
|
|
|
c38cbc |
This assumption in the cgroup code causes a UAF because struct
|
|
|
c38cbc |
fs_parameter uses a union for the actual value. Access to that union is
|
|
|
c38cbc |
guarded by the param->type member. Since the cgroup paramter parser
|
|
|
c38cbc |
didn't check param->type but unconditionally moved param->string into
|
|
|
c38cbc |
fc->source a close on the fscontext_fd would trigger a UAF during
|
|
|
c38cbc |
put_fs_context() which frees fc->source thereby freeing the file stashed
|
|
|
c38cbc |
in param->file causing a UAF during a close of the fd_null.
|
|
|
c38cbc |
|
|
|
c38cbc |
Fix this by verifying that param->type is actually a string and report
|
|
|
c38cbc |
an error if not.
|
|
|
c38cbc |
|
|
|
c38cbc |
In follow up patches I'll add a new generic helper that can be used here
|
|
|
c38cbc |
and by other filesystems instead of this error-prone copy-pasta fix.
|
|
|
c38cbc |
But fixing it in here first makes backporting a it to stable a lot
|
|
|
c38cbc |
easier.
|
|
|
c38cbc |
|
|
|
c38cbc |
Fixes: 8d2451f4994f ("cgroup1: switch to option-by-option parsing")
|
|
|
c38cbc |
Reported-by: syzbot+283ce5a46486d6acdbaf@syzkaller.appspotmail.com
|
|
|
c38cbc |
Cc: Christoph Hellwig <hch@lst.de>
|
|
|
c38cbc |
Cc: Alexander Viro <viro@zeniv.linux.org.uk>
|
|
|
c38cbc |
Cc: Dmitry Vyukov <dvyukov@google.com>
|
|
|
c38cbc |
Cc: <stable@kernel.org>
|
|
|
c38cbc |
Cc: syzkaller-bugs <syzkaller-bugs@googlegroups.com>
|
|
|
c38cbc |
Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
|
|
|
c38cbc |
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
|
c38cbc |
|
|
|
c38cbc |
Signed-off-by: Waiman Long <longman@redhat.com>
|
|
|
c38cbc |
Signed-off-by: Bruno Meneguele <bmeneg@redhat.com>
|
|
|
c38cbc |
|
|
|
c38cbc |
Signed-off-by: Artem Savkov <asavkov@redhat.com>
|
|
|
c38cbc |
---
|
|
|
c38cbc |
kernel/cgroup/cgroup-v1.c | 2 ++
|
|
|
c38cbc |
1 file changed, 2 insertions(+)
|
|
|
c38cbc |
|
|
|
c38cbc |
diff --git a/kernel/cgroup/cgroup-v1.c b/kernel/cgroup/cgroup-v1.c
|
|
|
c38cbc |
index 852f1349f9d9..291754068ec6 100644
|
|
|
c38cbc |
--- a/kernel/cgroup/cgroup-v1.c
|
|
|
c38cbc |
+++ b/kernel/cgroup/cgroup-v1.c
|
|
|
c38cbc |
@@ -907,6 +907,8 @@ int cgroup1_parse_param(struct fs_context *fc, struct fs_parameter *param)
|
|
|
c38cbc |
opt = fs_parse(fc, cgroup1_fs_parameters, param, &result);
|
|
|
c38cbc |
if (opt == -ENOPARAM) {
|
|
|
c38cbc |
if (strcmp(param->key, "source") == 0) {
|
|
|
c38cbc |
+ if (param->type != fs_value_is_string)
|
|
|
c38cbc |
+ return invalf(fc, "Non-string source");
|
|
|
c38cbc |
if (fc->source)
|
|
|
c38cbc |
return invalf(fc, "Multiple sources not supported");
|
|
|
c38cbc |
fc->source = param->string;
|
|
|
c38cbc |
--
|
|
|
c38cbc |
2.34.1
|
|
|
c38cbc |
|
|
|
c38cbc |
|