In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/mm\/pat: Acquire init_mm read lock on attribute changes to avoid UAF<\/p>\n
A previous commit protected against races between ptdump and CPA collapse,
\nhowever one still exists between attribute changes and collapse as reported
\nby Denis V. Lunev (linked).<\/p>\n
When an attribute change arises, a lockless page table walker obtains a PTE
\nentry, which is later written to via set_pte_atomic():<\/p>\n
…
\n -> change_page_attr_set_clr()
\n -> __change_page_attr_set_clr()
\n -> __change_page_attr()
\n\t-> _lookup_address_cpa()
\n\t-> lookup_address_in_pgd_attr()
\n\t-> [ lockless page table walker ]
\n -> set_pte_atomic()<\/p>\n
There is nothing preventing a concurrent CPA collapse which can free the
\nPTE that was retrieved here, resulting in a use-after-free.<\/p>\n
With the mmap write lock taken on init_mm over CPA collapse, resolve this
\nrace by acquiring an mmap read lock on init_mm over
\n__change_page_attr_set_clr().<\/p>\n
This locks across the whole operation over which the walk and the PTE
\nentry write occurs, solving the race.<\/p>\n
It is safe to do this here, as no spinlocks are held upon entry to
\n__change_page_attr_set_clr().<\/p>\n
However, the lock must not be held over an allocation, as allocation can
\ntrigger reclaim and shrinkers may call into CPA recursively, making
\ndeadlocks possible (init_mm -> … -> fs_reclaim -> init_mm).<\/p>\n
A page table is allocated when a huge page needs to be split:<\/p>\n
-> change_page_attr_set_clr()
\n -> __change_page_attr_set_clr()
\n -> __change_page_attr()
\n -> split_large_page()
\n [ pagetable_alloc() ]
\n -> __split_large_page()<\/p>\n
Avoid deadlocks by dropping the mmap lock across pagetable_alloc() in
\nsplit_large_page() and track whether this is needed by adding a new
\n‘init_mm_read_locked’ flag to struct cpa_data.<\/p>\n
This is safe as __split_large_page() (called with locks re-established)
\nrevalidates that the page table entry is the same as it was prior to the
\nlocks being dropped and __change_page_attr() repeats the entire page table
\nwalk whenever a split occurs, so concurrent split and collapse are
\naccounted for.<\/p>\n
Concurrent ptdump is also safe as the lock is only dropped over page table
\nallocation during which time the page table has not yet been modified.<\/p>\n
The CPA_COLLAPSE flag is only set by set_memory_rox(), which exclusively
\noperates upon vmalloc ranges, and on x86 only within the module mapping
\nspace.<\/p>\n
This is important, because some callers directly invoke
\n__change_page_attr_set_clr(), bypassing this lock. However, none of these
\noperate within the module mapping space.<\/p>\n
* cpa_process_alias() – a recursive helper called by
\n __change_page_attr_set_clr().
\n * __set_memory_enc_pgtable() – operates on the direct mapping and (via
\n __vmbus_establish_gpadl()) the vmalloc mapping space.
\n * __set_pages_[n]p() – called by set_direct_map_[invalid, default,
\n valid]_noflush(), __kernel_map_pages() – operates on the direct map.
\n * kernel_[un]map_pages_in_pgd() – operates on EFI ranges.<\/p>\n
This work is based upon Denis V. Lunev’s excellent analysis of the bug
\nwith gratitude.<\/p>\n
[ dhansen: move to imperative voice in changelog ]<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
x86\/mm\/pat: Acquire init_mm read lock on attribute changes to avoid UAF<\/p>\n
A previous commit protected against races between ptdump a<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-28965","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/28965","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=28965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=28965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=28965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}