In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: use kvfree() for replaced sysctl write buffer<\/p>\n
proc_sys_call_handler() allocates its temporary sysctl buffer with
\nkvzalloc() and passes it to __cgroup_bpf_run_filter_sysctl(). Since
\nkvzalloc() may fall back to vmalloc() for large allocations, freeing
\nthat buffer with kfree() is wrong and can corrupt memory.<\/p>\n
Use kvfree() to safely handle both kmalloc and kvzalloc()\/vmalloc
\nallocations.<\/p>\n
The bug was first flagged by an experimental analysis tool we are
\ndeveloping for kernel memory-management bugs while analyzing
\nv6.13-rc1. The tool is still under development and is not yet publicly
\navailable. Manual inspection confirms that the bug is still
\npresent in v7.1-rc5.<\/p>\n
Reproduced the bug based on v7.1-rc4 in a QEMU x86_64 guest booted with
\nKASAN and CONFIG_FAILSLAB enabled. To exercise the replacement path, the
\ntest tree also included the accompanying fix for the stale ret == 1
\ncheck in __cgroup_bpf_run_filter_sysctl(). The reproducer confines
\nfailslab injections to the proc_sys_call_handler() range, uses
\nstacktrace-depth=32, and injects fail-nth=1 while writing 8191 bytes to
\n\/proc\/sys\/kernel\/domainname from a task in the target cgroup. Under
\nthat setup, fail-nth=1 triggered the fault:<\/p>\n
BUG: unable to handle page fault for address: ffffeb0200024d48
\n #PF: supervisor read access in kernel mode
\n #PF: error_code(0x0000) – not-present page
\n PGD 0 P4D 0
\n Oops: Oops: 0000 SMP KASAN NOPTI
\n CPU: 2 UID: 0 PID: 209 Comm: repro_proc_sys_ Not tainted 7.1.0-rc4-00686-g97625979a5d4 PREEMPT(lazy)
\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.15.0-1 04\/01\/2014
\n RIP: 0010:kfree+0x6e\/0x510
\n …
\n Call Trace:<\/p>\n
? __cgroup_bpf_run_filter_sysctl+0x626\/0xc30
\n __cgroup_bpf_run_filter_sysctl+0x74d\/0xc30
\n ? __pfx___cgroup_bpf_run_filter_sysctl+0x10\/0x10
\n ? srso_return_thunk+0x5\/0x5f
\n ? __kvmalloc_node_noprof+0x345\/0x870
\n ? proc_sys_call_handler+0x250\/0x480
\n ? srso_return_thunk+0x5\/0x5f
\n proc_sys_call_handler+0x3a2\/0x480
\n ? __pfx_proc_sys_call_handler+0x10\/0x10
\n ? srso_return_thunk+0x5\/0x5f
\n ? selinux_file_permission+0x39f\/0x500
\n ? srso_return_thunk+0x5\/0x5f
\n ? lock_is_held_type+0x9e\/0x120
\n vfs_write+0x98e\/0x1000
\n …<\/p>\n
With this fix applied on top of the same test setup, rerunning the
\nreproducer with fail-nth=1 yields no corresponding Oops reports.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
bpf: use kvfree() for replaced sysctl write buffer<\/p>\n
proc_sys_call_handler() allocates its temporary sysctl buffer with
\nkvzalloc() a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-14886","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/14886","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=14886"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=14886"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=14886"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}