In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
apparmor: fix cred UAF caused by begin_current_label_crit_section()<\/p>\n
AppArmor’s begin_current_label_crit_section() is a scary function called
\nfrom lots of LSM hooks (in particular VFS\/socket-related ones) that checks
\nif the label referenced by the current creds is marked FLAG_STALE, and if
\nso, attempts to use aa_replace_current_label() to replace the creds with an
\nupdated version that uses a new label.<\/p>\n
The first problem with this is that it would directly lead to UAF of
\n`struct cred` if anything in the kernel takes a pointer to the current
\ncreds and accesses these past a security hook invocation that replaces
\ncreds, like so:
\n“`
\nconst struct cred *cred = current_cred();
\nalloc_file_pseudo(…);
\nuid_t uid = cred->euid;
\n“`
\nI don’t know if anything in the kernel actually does this, but I think it
\nis very surprising that this pattern could lead to UAF.<\/p>\n
The second problem is that things go wrong when aa_replace_current_label()
\nruns with overridden credentials. aa_replace_current_label() bails out if
\n`current_cred() != current_real_cred()` (mirroring the check in
\nproc_pid_attr_write()), but this check can’t actually reliably detect
\noverridden credentials because the overridden creds can be the same as the
\nobjective creds.<\/p>\n
So in approximately the following scenario, things go wrong:<\/p>\n
1. task begins with (as both objective and subjective creds),
\n with refcount=2
\n2. task grabs an extra reference on for overriding
\n3. task calls override_creds(), which returns a pointer to the old
\n subjective creds ()
\n4. task enters AppArmor LSM hook
\n5. AppArmor checks that objective\/subjective creds are equal
\n6. AppArmor replaces both cred pointers with and drops 2 refs on<\/p>\n
7. task leaves AppArmor LSM hook
\n8. task calls revert_creds()
\n9. now task->cred is while task->real_cred is , but the
\n task_struct logically holds two references to
\n10. another task drops the extra reference on that was used for
\n overriding, refcount drops to 0
\n11. now task->real_cred points to freed creds<\/p>\n
At this point, any access to current_cred() will be UAF.<\/p>\n
I have a test case where I run aa-disable on a profile while a process
\nusing that profile is blocked on splice() from a FUSE passthrough file into
\na full pipe; after the profile update, the pipe becomes empty, splice()
\nresumes, the credentials go out of sync, and a subsequent getuid() syscall
\nresults in a KASAN UAF splat.<\/p>\n
To fix this, instead of directly replacing creds, do it via task_work that
\nwill run at the end of the current syscall. (The point in time at which the
\ncred replacement happens should have no correctness impact; it is just a
\nperformance optimization to avoid unnecessarily touching the refcount of
\nthe new label.)<\/p>\n
Note that AppArmor still performs direct cred replacements in the
\nsb_pivotroot LSM hook after this change, and that direct cred replacements
\ncan still happen in VFS ->write() callbacks via proc_pid_attr_write().<\/p>\n
There are two options for what to do with aa_dup_task_ctx(): Either
\nexplicitly reset new->label_replacement_pending after the entire
\naa_task_ctx has been copied, or switch to manually copying members over.
\nI am switching to manually copying members over because that should make
\nbugs more obvious.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
apparmor: fix cred UAF caused by begin_current_label_crit_section()<\/p>\n
AppArmor’s begin_current_label_crit_section() is a scary funct<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-21684","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/21684","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=21684"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=21684"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=21684"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}