In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tls: device: fix out-of-bounds write in tls_append_frag()<\/p>\n
Found with syzkaller and a local syzbot instance running on top of a
\nnetdevsim TLS offload emulation; tls_device.c is otherwise only reachable
\non a machine with a NIC that implements the offload.<\/p>\n
tls_push_data() only checks whether the open record still has room for
\nanother frag at the bottom of its loop, and the MSG_MORE early break
\nskips that check. The record survives to the next syscall with the frag
\ncount it already had, and tls_append_frag() does not check either, so
\nwith TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds
\na non-coalescing pipe page and num_frags walks off the end of
\ntls_record_info.frags[MAX_SKB_FRAGS]. Once the record is pushed,
\ntls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and
\nthe sg_set_page() writes land on the destruct_work that follows it, which
\nthe workqueue then calls.<\/p>\n
The byte limit is fine because copy drops to 0 and the loop falls through
\nto the same check; the frag count has no such feedback.<\/p>\n
Push the record rather than keep a full one open, which is what a plain
\nTCP socket does – tcp_sendmsg_locked() uses tcp_mark_push() and
\nnew_segment in both the copy and the MSG_SPLICE_PAGES paths, and tls_sw
\nalready sets full_record when the sk_msg ring fills up, MSG_MORE or not.<\/p>\n
BUG: KASAN: slab-out-of-bounds in tls_append_frag ( net\/tls\/tls_device.c:269)
\n Write of size 8 at addr ffff8881104d1530 by task tls_oob\/450<\/p>\n
CPU: 2 UID: 0 PID: 450 Comm: tls_oob Not tainted 7.2.0-rc7+ #329 PREEMPT
\n Call Trace:<\/p>\n
dump_stack_lvl (lib\/dump_stack.c:94 lib\/dump_stack.c:120)
\n print_report (mm\/kasan\/report.c:378 mm\/kasan\/report.c:482)
\n kasan_report (mm\/kasan\/report.c:595)
\n tls_append_frag (net\/tls\/tls_device.c:269)
\n tls_push_data (net\/tls\/tls_device.c:518)
\n tls_device_sendmsg (net\/tls\/tls_device.c:583)
\n inet_sendmsg (net\/ipv4\/af_inet.c:865)
\n sock_sendmsg (net\/socket.c:775 net\/socket.c:790 net\/socket.c:813)
\n splice_to_socket (fs\/splice.c:884)
\n do_splice (fs\/splice.c:936 fs\/splice.c:1349)
\n __do_splice (fs\/splice.c:1431)
\n __x64_sys_splice (fs\/splice.c:1634 fs\/splice.c:1616)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:63 arch\/x86\/entry\/syscall_64.c:94)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n
and, once the record is pushed:<\/p>\n
UBSAN: array-index-out-of-bounds in net\/tls\/tls_device.c:300:24
\n index 18 is out of range for type ‘skb_frag_t [17]’
\n UBSAN: array-index-out-of-bounds in net\/tls\/tls_device.c:301:41
\n index 18 is out of range for type ‘scatterlist [17]’
\n UBSAN: array-index-out-of-bounds in net\/tls\/tls_device.c:302:39
\n index 18 is out of range for type ‘scatterlist [17]’
\n UBSAN: array-index-out-of-bounds in net\/tls\/tls_device.c:307:38
\n index 26 is out of range for type ‘scatterlist [17]’<\/p>\n
kernel tried to execute NX-protected page – exploit attempt? (uid: 0)
\n BUG: unable to handle page fault for address: ffffea000411a680
\n #PF: supervisor instruction fetch in kernel mode
\n #PF: error_code(0x0011) – permissions violation
\n Oops: Oops: 0011 [#1] SMP KASAN PTI
\n Workqueue: ktls_device_destruct 0xffffea000411a680
\n RIP: 0010:0xffffea000411a680
\n Call Trace:<\/p>\n
worker_thread (kernel\/workqueue.c:3405 kernel\/workqueue.c:3486)
\n kthread (kernel\/kthread.c:436)
\n ret_from_fork (arch\/x86\/kernel\/process.c:158)
\n ret_from_fork_asm (arch\/x86\/entry\/entry_64.S:245)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
tls: device: fix out-of-bounds write in tls_append_frag()<\/p>\n
Found with syzkaller and a local syzbot instance running on top of a
\nnet<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17356","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}