In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: act_ct: Only release RCU read lock after ct_ft<\/p>\n
When looking up a flow table in act_ct in tcf_ct_flow_table_get(),
\nrhashtable_lookup_fast() internally opens and closes an RCU read critical
\nsection before returning ct_ft.
\nThe tcf_ct_flow_table_cleanup_work() can complete before refcount_inc_not_zero()
\nis invoked on the returned ct_ft resulting in a UAF on the already freed ct_ft
\nobject. This vulnerability can lead to privilege escalation.<\/p>\n
Analysis from zdi-disclosures@trendmicro.com:
\nWhen initializing act_ct, tcf_ct_init() is called, which internally triggers
\ntcf_ct_flow_table_get().<\/p>\n
static int tcf_ct_flow_table_get(struct net *net, struct tcf_ct_params *params)<\/p>\n
{
\n struct zones_ht_key key = { .net = net, .zone = params->zone };
\n struct tcf_ct_flow_table *ct_ft;
\n int err = -ENOMEM;<\/p>\n
mutex_lock(&zones_mutex);
\n ct_ft = rhashtable_lookup_fast(&zones_ht, &key, zones_params); \/\/ [1]
\n if (ct_ft && refcount_inc_not_zero(&ct_ft->ref)) \/\/ [2]
\n goto out_unlock;
\n …
\n}<\/p>\n
static __always_inline void *rhashtable_lookup_fast(
\n struct rhashtable *ht, const void *key,
\n const struct rhashtable_params params)
\n{
\n void *obj;<\/p>\n
rcu_read_lock();
\n obj = rhashtable_lookup(ht, key, params);
\n rcu_read_unlock();<\/p>\n
return obj;
\n}<\/p>\n
At [1], rhashtable_lookup_fast() looks up and returns the corresponding ct_ft
\nfrom zones_ht . The lookup is performed within an RCU read critical section
\nthrough rcu_read_lock() \/ rcu_read_unlock(), which prevents the object from
\nbeing freed. However, at the point of function return, rcu_read_unlock() has
\nalready been called, and there is nothing preventing ct_ft from being freed
\nbefore reaching refcount_inc_not_zero(&ct_ft->ref) at [2]. This interval becomes
\nthe race window, during which ct_ft can be freed.<\/p>\n
Free Process:<\/p>\n
tcf_ct_flow_table_put() is executed through the path tcf_ct_cleanup() call_rcu()
\ntcf_ct_params_free_rcu() tcf_ct_params_free() tcf_ct_flow_table_put().<\/p>\n
static void tcf_ct_flow_table_put(struct tcf_ct_flow_table *ct_ft)
\n{
\n if (refcount_dec_and_test(&ct_ft->ref)) {
\n rhashtable_remove_fast(&zones_ht, &ct_ft->node, zones_params);
\n INIT_RCU_WORK(&ct_ft->rwork, tcf_ct_flow_table_cleanup_work); \/\/ [3]
\n queue_rcu_work(act_ct_wq, &ct_ft->rwork);
\n }
\n}<\/p>\n
At [3], tcf_ct_flow_table_cleanup_work() is scheduled as RCU work<\/p>\n
static void tcf_ct_flow_table_cleanup_work(struct work_struct *work)<\/p>\n
{
\n struct tcf_ct_flow_table *ct_ft;
\n struct flow_block *block;<\/p>\n
ct_ft = container_of(to_rcu_work(work), struct tcf_ct_flow_table,
\n rwork);
\n nf_flow_table_free(&ct_ft->nf_ft);
\n block = &ct_ft->nf_ft.flow_block;
\n down_write(&ct_ft->nf_ft.flow_block_lock);
\n WARN_ON(!list_empty(&block->cb_list));
\n up_write(&ct_ft->nf_ft.flow_block_lock);
\n kfree(ct_ft); \/\/ [4]<\/p>\n
module_put(THIS_MODULE);
\n}<\/p>\n
tcf_ct_flow_table_cleanup_work() frees ct_ft at [4]. When this function executes
\nbetween [1] and [2], UAF occurs.<\/p>\n
This race condition has a very short race window, making it generally
\ndifficult to trigger. Therefore, to trigger the vulnerability an msleep(100) was
\ninserted after[1]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
net\/sched: act_ct: Only release RCU read lock after ct_ft<\/p>\n
When looking up a flow table in act_ct in tcf_ct_flow_table_get(),
\nrhash<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-16124","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/16124","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16124"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16124"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16124"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}