In the Linux kernel, the following vulnerability has been resolved:
padata: Fix refcnt handling in padatafreeshell()
In a high-load arm64 environment, the pcryptaead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcryptaead01 function call, I'll describe the problem scenario using a simplified model:
Suppose there's a user of padata named user_function that adheres to
the padata requirement of calling padata_free_shell after serial()
has been invoked, as demonstrated in the following code:
struct request {
struct padata_priv padata;
struct completion *done;
};
void parallel(struct padata_priv *padata) {
do_something();
}
void serial(struct padata_priv *padata) {
struct request *request = container_of(padata,
struct request,
padata);
complete(request->done);
}
void user_function() {
DECLARE_COMPLETION(done)
padata->parallel = parallel;
padata->serial = serial;
padata_do_parallel();
wait_for_completion(&done);
padata_free_shell();
}
In the corresponding padata.c file, there's the following code:
static void padata_serial_worker(struct work_struct *serial_work) {
...
cnt = 0;
while (!list_empty(&local_list)) {
...
padata->serial(padata);
cnt++;
}
local_bh_enable();
if (refcount_sub_and_test(cnt, &pd->refcnt))
padata_free_pd(pd);
}
Because of the high system load and the accumulation of unexecuted
softirq at this moment, local_bh_enable() in padata takes longer
to execute than usual. Subsequently, when accessing pd->refcnt,
pd has already been released by padata_free_shell(), resulting
in a UAF issue with pd->refcnt.
The fix is straightforward: add refcount_dec_and_test before calling
padata_free_pd in padata_free_shell.
[
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"279570454526059000033870917128847285839",
"310108989541595015145968043873039706991",
"148164213784324680247347988989254177676",
"288889855144388594895788332503958788908",
"313203998478253391509443594594670120053",
"60561605752047916195887268173511930909",
"290993360979357164858688912862221444488",
"132005734677639996892651252800307469400",
"129392698179503764694933645772937614709"
]
},
"target": {
"file": "kernel/padata.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41aad9d6953984d134fc50f631f24ef476875d4d",
"id": "CVE-2023-52854-0741f9ed"
},
{
"digest": {
"length": 236.0,
"function_hash": "38496666732383425767116365527652596505"
},
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ddc21e317b360c3444de3023bcc83b85fabae2f",
"id": "CVE-2023-52854-15d2cdea"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"279570454526059000033870917128847285839",
"310108989541595015145968043873039706991",
"148164213784324680247347988989254177676",
"288889855144388594895788332503958788908",
"313203998478253391509443594594670120053",
"60561605752047916195887268173511930909",
"290993360979357164858688912862221444488",
"132005734677639996892651252800307469400",
"129392698179503764694933645772937614709"
]
},
"target": {
"file": "kernel/padata.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e901bcb8af19416b65f5063a4af7996e5a51d7f",
"id": "CVE-2023-52854-160e853a"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"279570454526059000033870917128847285839",
"310108989541595015145968043873039706991",
"148164213784324680247347988989254177676",
"288889855144388594895788332503958788908",
"313203998478253391509443594594670120053",
"60561605752047916195887268173511930909",
"290993360979357164858688912862221444488",
"132005734677639996892651252800307469400",
"129392698179503764694933645772937614709"
]
},
"target": {
"file": "kernel/padata.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275",
"id": "CVE-2023-52854-21e0674a"
},
{
"digest": {
"length": 236.0,
"function_hash": "38496666732383425767116365527652596505"
},
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5",
"id": "CVE-2023-52854-2ac4fae3"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"279570454526059000033870917128847285839",
"310108989541595015145968043873039706991",
"148164213784324680247347988989254177676",
"288889855144388594895788332503958788908",
"313203998478253391509443594594670120053",
"60561605752047916195887268173511930909",
"290993360979357164858688912862221444488",
"132005734677639996892651252800307469400",
"129392698179503764694933645772937614709"
]
},
"target": {
"file": "kernel/padata.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1734a79e951914f1db2c65e635012a35db1c674b",
"id": "CVE-2023-52854-5faa4a6e"
},
{
"digest": {
"length": 236.0,
"function_hash": "38496666732383425767116365527652596505"
},
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1734a79e951914f1db2c65e635012a35db1c674b",
"id": "CVE-2023-52854-759f98bf"
},
{
"digest": {
"length": 236.0,
"function_hash": "38496666732383425767116365527652596505"
},
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e901bcb8af19416b65f5063a4af7996e5a51d7f",
"id": "CVE-2023-52854-82f186d4"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"279570454526059000033870917128847285839",
"310108989541595015145968043873039706991",
"148164213784324680247347988989254177676",
"288889855144388594895788332503958788908",
"313203998478253391509443594594670120053",
"60561605752047916195887268173511930909",
"290993360979357164858688912862221444488",
"132005734677639996892651252800307469400",
"129392698179503764694933645772937614709"
]
},
"target": {
"file": "kernel/padata.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5",
"id": "CVE-2023-52854-ad526d0e"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"279570454526059000033870917128847285839",
"310108989541595015145968043873039706991",
"148164213784324680247347988989254177676",
"288889855144388594895788332503958788908",
"313203998478253391509443594594670120053",
"60561605752047916195887268173511930909",
"290993360979357164858688912862221444488",
"132005734677639996892651252800307469400",
"129392698179503764694933645772937614709"
]
},
"target": {
"file": "kernel/padata.c"
},
"signature_type": "Line",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ddc21e317b360c3444de3023bcc83b85fabae2f",
"id": "CVE-2023-52854-b0e62c7c"
},
{
"digest": {
"length": 236.0,
"function_hash": "38496666732383425767116365527652596505"
},
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41aad9d6953984d134fc50f631f24ef476875d4d",
"id": "CVE-2023-52854-cdf07ba7"
},
{
"digest": {
"length": 236.0,
"function_hash": "38496666732383425767116365527652596505"
},
"target": {
"function": "padata_free_shell",
"file": "kernel/padata.c"
},
"signature_type": "Function",
"deprecated": false,
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275",
"id": "CVE-2023-52854-df986d00"
}
]