255869 2021-05-14 11:45:04 +0000 [PATCH] kern: Fix a use after free bug in sodealloc 2021-05-25 13:29:55 +0000 1 1 1 Unclassified Base System kern CURRENT Any Any Closed FIXED --- Affects Many People --- 1 lylgood markj markj oldest_to_newest 1161293 0 224933 lylgood 2021-05-14 11:45:04 +0000 Created attachment 224933 adds a variable cr_uidinfo Bug File: sys/kern/uipc_socket.c In Function sodealloc, so->so_cred is freed via crfree() at line 479. But, the freed so->so_cred is dereferenced by so->so_cred->cr_uidinfo at line 486 and 489, which are uaf bugs. My patch adds a variable cr_uidinfo to avoid the uaf bugs. 1161821 1 markj 2021-05-17 18:14:01 +0000 I think this is not formally correct. The uidinfo structure itself is protected by a reference count which is owned by the cred reference. Really we should simply defer the crfree() call to until after the chgsbsize() calls. 1161877 2 225050 lylgood 2021-05-18 03:25:22 +0000 Created attachment 225050 V2: defer the crfree to avoid uaf. 1161878 3 lylgood 2021-05-18 03:27:27 +0000 (In reply to Mark Johnston from comment #1) Thanks for your relpy, i have correct my patch which defers the crfree(). Please check the correctness. Thanks. 1162012 4 commit-hook 2021-05-18 19:44:54 +0000 A commit in branch main references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=b295c5ddcef4744ef7044d2327b4258b6ad055f0 commit b295c5ddcef4744ef7044d2327b4258b6ad055f0 Author: Lv Yunlong <lylgood@foxmail.com> AuthorDate: 2021-05-18 19:23:15 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-05-18 19:25:40 +0000 socket: Release cred reference later in sodealloc() We dereference so->so_cred to update the per-uid socket buffer accounting, so the crfree() call must be deferred until after that point. PR: 255869 MFC after: 1 week sys/kern/uipc_socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) 1163052 5 commit-hook 2021-05-25 13:28:50 +0000 A commit in branch stable/13 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=e53b671b4f75fe86ace1cb78566ccdbdb56aad01 commit e53b671b4f75fe86ace1cb78566ccdbdb56aad01 Author: Lv Yunlong <lylgood@foxmail.com> AuthorDate: 2021-05-18 19:23:15 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-05-25 13:26:00 +0000 socket: Release cred reference later in sodealloc() We dereference so->so_cred to update the per-uid socket buffer accounting, so the crfree() call must be deferred until after that point. PR: 255869 (cherry picked from commit b295c5ddcef4744ef7044d2327b4258b6ad055f0) sys/kern/uipc_socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) 1163057 6 commit-hook 2021-05-25 13:29:55 +0000 A commit in branch stable/12 references this bug: URL: https://cgit.FreeBSD.org/src/commit/?id=3a84efbedca5c8c45e40bdcaa4e1ae0e15fff94d commit 3a84efbedca5c8c45e40bdcaa4e1ae0e15fff94d Author: Lv Yunlong <lylgood@foxmail.com> AuthorDate: 2021-05-18 19:23:15 +0000 Commit: Mark Johnston <markj@FreeBSD.org> CommitDate: 2021-05-25 13:28:54 +0000 socket: Release cred reference later in sodealloc() We dereference so->so_cred to update the per-uid socket buffer accounting, so the crfree() call must be deferred until after that point. PR: 255869 (cherry picked from commit b295c5ddcef4744ef7044d2327b4258b6ad055f0) sys/kern/uipc_socket.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) 224933 2021-05-14 11:45:04 +0000 2021-05-18 03:25:22 +0000 adds a variable cr_uidinfo 0001-kern-uaf-sodealloc.patch text/plain 1122 lylgood ZGlmZiAtLWdpdCBhL3N5cy9rZXJuL3VpcGNfc29ja2V0LmMgYi9zeXMva2Vybi91aXBjX3NvY2tl dC5jCmluZGV4IGVhODZmNjY1NTZlYS4uM2I4NGQxODNhNjZjIDEwMDY0NAotLS0gYS9zeXMva2Vy bi91aXBjX3NvY2tldC5jCisrKyBiL3N5cy9rZXJuL3VpcGNfc29ja2V0LmMKQEAgLTQ1OCw2ICs0 NTgsNyBAQCBzb2FsbG9jKHN0cnVjdCB2bmV0ICp2bmV0KQogc3RhdGljIHZvaWQKIHNvZGVhbGxv YyhzdHJ1Y3Qgc29ja2V0ICpzbykKIHsKKwlzdHJ1Y3QgdWlkaW5mbwkqY3JfdWlkaW5mbzsKIAog CUtBU1NFUlQoc28tPnNvX2NvdW50ID09IDAsICgic29kZWFsbG9jKCk6IHNvX2NvdW50ICVkIiwg c28tPnNvX2NvdW50KSk7CiAJS0FTU0VSVChzby0+c29fcGNiID09IE5VTEwsICgic29kZWFsbG9j KCk6IHNvX3BjYiAhPSBOVUxMIikpOwpAQCAtNDc2LDYgKzQ3Nyw3IEBAIHNvZGVhbGxvYyhzdHJ1 Y3Qgc29ja2V0ICpzbykKICNlbmRpZgogCWhob29rX3J1bl9zb2NrZXQoc28sIE5VTEwsIEhIT09L X1NPQ0tFVF9DTE9TRSk7CiAKKwljcl91aWRpbmZvID0gc28tPnNvX2NyZWQtPmNyX3VpZGluZm87 CiAJY3JmcmVlKHNvLT5zb19jcmVkKTsKIAlraGVscF9kZXN0cm95X29zZCgmc28tPm9zZCk7CiAJ aWYgKFNPTElTVEVOSU5HKHNvKSkgewpAQCAtNDgzLDEwICs0ODUsMTAgQEAgc29kZWFsbG9jKHN0 cnVjdCBzb2NrZXQgKnNvKQogCQkJYWNjZXB0X2ZpbHRfc2V0b3B0KHNvLCBOVUxMKTsKIAl9IGVs c2UgewogCQlpZiAoc28tPnNvX3Jjdi5zYl9oaXdhdCkKLQkJCSh2b2lkKWNoZ3Nic2l6ZShzby0+ c29fY3JlZC0+Y3JfdWlkaW5mbywKKwkJCSh2b2lkKWNoZ3Nic2l6ZShjcl91aWRpbmZvLAogCQkJ ICAgICZzby0+c29fcmN2LnNiX2hpd2F0LCAwLCBSTElNX0lORklOSVRZKTsKIAkJaWYgKHNvLT5z b19zbmQuc2JfaGl3YXQpCi0JCQkodm9pZCljaGdzYnNpemUoc28tPnNvX2NyZWQtPmNyX3VpZGlu Zm8sCisJCQkodm9pZCljaGdzYnNpemUoY3JfdWlkaW5mbywKIAkJCSAgICAmc28tPnNvX3NuZC5z Yl9oaXdhdCwgMCwgUkxJTV9JTkZJTklUWSk7CiAJCXN4X2Rlc3Ryb3koJnNvLT5zb19zbmQuc2Jf c3gpOwogCQlzeF9kZXN0cm95KCZzby0+c29fcmN2LnNiX3N4KTsK 225050 2021-05-18 03:25:22 +0000 2021-05-18 03:25:22 +0000 V2: defer the crfree to avoid uaf. 0002-v2-sys-kern-fix-uaf-sodealloc.patch text/plain 599 lylgood ZGlmZiAtLWdpdCBhL3N5cy9rZXJuL3VpcGNfc29ja2V0LmMgYi9zeXMva2Vybi91aXBjX3NvY2tl dC5jCmluZGV4IGVhODZmNjY1NTZlYS4uMmExNjdlYjY4YTIyIDEwMDY0NAotLS0gYS9zeXMva2Vy bi91aXBjX3NvY2tldC5jCisrKyBiL3N5cy9rZXJuL3VpcGNfc29ja2V0LmMKQEAgLTQ3Niw3ICs0 NzYsNiBAQCBzb2RlYWxsb2Moc3RydWN0IHNvY2tldCAqc28pCiAjZW5kaWYKIAloaG9va19ydW5f c29ja2V0KHNvLCBOVUxMLCBISE9PS19TT0NLRVRfQ0xPU0UpOwogCi0JY3JmcmVlKHNvLT5zb19j cmVkKTsKIAlraGVscF9kZXN0cm95X29zZCgmc28tPm9zZCk7CiAJaWYgKFNPTElTVEVOSU5HKHNv KSkgewogCQlpZiAoc28tPnNvbF9hY2NlcHRfZmlsdGVyICE9IE5VTEwpCkBAIC00OTMsNiArNDky LDcgQEAgc29kZWFsbG9jKHN0cnVjdCBzb2NrZXQgKnNvKQogCQlTT0NLQlVGX0xPQ0tfREVTVFJP WSgmc28tPnNvX3NuZCk7CiAJCVNPQ0tCVUZfTE9DS19ERVNUUk9ZKCZzby0+c29fcmN2KTsKIAl9 CisJY3JmcmVlKHNvLT5zb19jcmVkKTsKIAltdHhfZGVzdHJveSgmc28tPnNvX2xvY2spOwogCXVt YV96ZnJlZShzb2NrZXRfem9uZSwgc28pOwogfQo=