In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sunrpc: init gssp_lock before publishing proc entry<\/p>\n
create_use_gss_proxy_proc_entry() publishes \/proc\/net\/rpc\/use-gss-proxy
\nvia proc_create_data() before init_gssp_clnt() runs mutex_init() on
\nsn->gssp_lock. Once the dentry is linked under proc_subdir_lock it is
\nimmediately reachable from userspace, so a write that lands in the
\nwindow drives set_gssp_clnt() into mutex_lock() on a zero-initialized
\nstruct mutex.<\/p>\n
create_use_gss_proxy_proc_entry(net)
\n proc_create_data(“use-gss-proxy”, …) \/* dentry live *\/
\n init_gssp_clnt(sn)
\n mutex_init(&sn->gssp_lock) \/* too late *\/<\/p>\n
write_gssp()
\n set_gssp_clnt(net)
\n mutex_lock(&sn->gssp_lock) \/* uninitialized *\/
\n gssp_rpc_create(…)
\n sn->gssp_clnt = clnt
\n mutex_unlock(&sn->gssp_lock)<\/p>\n
The window spans only the two statements between proc_create_data()
\nreturning and init_gssp_clnt(), so a writer reaches it only if the
\nregistering thread is preempted there while another task is already
\nopening the freshly published file. register_pernet_subsys() runs in
\npreemptible context under pernet_ops_rwsem, so that preemption is
\npossible, and the window widens on auth_rpcgss module load, when the
\nproc entry is created for every live net namespace whose tasks are
\nalready running. A writer that wins the race locks a zero-filled
\nstruct mutex. On CONFIG_DEBUG_MUTEXES the missing magic value trips a
\n“lock used without init” splat; on a production kernel the fast path
\nacquires the lock via CMPXCHG(owner, 0, current). In the latter case
\na second writer that arrives before init_gssp_clnt() re-zeroes owner
\ncan enter set_gssp_clnt() concurrently, shut down the first writer’s
\nclnt while it is still in use, and leak the loser’s clnt.<\/p>\n
Fix by initializing sn->gssp_lock in sunrpc_init_net() so its lifetime
\nmatches the sunrpc_net it lives in. sn->gssp_clnt is already NULL from
\nthe kzalloc that backs net_generic storage, so the lazy helper is no
\nlonger needed; drop init_gssp_clnt(), its prototype, and the call from
\ncreate_use_gss_proxy_proc_entry(). sunrpc.ko is a build-time
\ndependency of auth_rpcgss.ko, so sunrpc_init_net() has always run on
\nevery netns before any auth_gss pernet init can publish the proc
\nentry.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
sunrpc: init gssp_lock before publishing proc entry<\/p>\n
create_use_gss_proxy_proc_entry() publishes \/proc\/net\/rpc\/use-gss-proxy
\nvia pr<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21462","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21462","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21462"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21462"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21462"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}