In the Linux kernel, the following vulnerability has been resolved:
padata: Fix refcnt handling in padatafreeshell()
In a high-load arm64 environment, the pcryptaead01 test in LTP can lead to system UAF (Use-After-Free) issues. Due to the lengthy analysis of the pcryptaead01 function call, I'll describe the problem scenario using a simplified model:
Suppose there's a user of padata named user_function
that adheres to
the padata requirement of calling padata_free_shell
after serial()
has been invoked, as demonstrated in the following code:
struct request {
struct padata_priv padata;
struct completion *done;
};
void parallel(struct padata_priv *padata) {
do_something();
}
void serial(struct padata_priv *padata) {
struct request *request = container_of(padata,
struct request,
padata);
complete(request->done);
}
void user_function() {
DECLARE_COMPLETION(done)
padata->parallel = parallel;
padata->serial = serial;
padata_do_parallel();
wait_for_completion(&done);
padata_free_shell();
}
In the corresponding padata.c file, there's the following code:
static void padata_serial_worker(struct work_struct *serial_work) {
...
cnt = 0;
while (!list_empty(&local_list)) {
...
padata->serial(padata);
cnt++;
}
local_bh_enable();
if (refcount_sub_and_test(cnt, &pd->refcnt))
padata_free_pd(pd);
}
Because of the high system load and the accumulation of unexecuted
softirq at this moment, local_bh_enable()
in padata takes longer
to execute than usual. Subsequently, when accessing pd->refcnt
,
pd
has already been released by padata_free_shell()
, resulting
in a UAF issue with pd->refcnt
.
The fix is straightforward: add refcount_dec_and_test
before calling
padata_free_pd
in padata_free_shell
.
{ "vanir_signatures": [ { "id": "CVE-2023-52854-0741f9ed", "signature_type": "Line", "target": { "file": "kernel/padata.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "279570454526059000033870917128847285839", "310108989541595015145968043873039706991", "148164213784324680247347988989254177676", "288889855144388594895788332503958788908", "313203998478253391509443594594670120053", "60561605752047916195887268173511930909", "290993360979357164858688912862221444488", "132005734677639996892651252800307469400", "129392698179503764694933645772937614709" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41aad9d6953984d134fc50f631f24ef476875d4d" }, { "id": "CVE-2023-52854-15d2cdea", "signature_type": "Function", "target": { "file": "kernel/padata.c", "function": "padata_free_shell" }, "signature_version": "v1", "digest": { "length": 236.0, "function_hash": "38496666732383425767116365527652596505" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ddc21e317b360c3444de3023bcc83b85fabae2f" }, { "id": "CVE-2023-52854-160e853a", "signature_type": "Line", "target": { "file": "kernel/padata.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "279570454526059000033870917128847285839", "310108989541595015145968043873039706991", "148164213784324680247347988989254177676", "288889855144388594895788332503958788908", "313203998478253391509443594594670120053", "60561605752047916195887268173511930909", "290993360979357164858688912862221444488", "132005734677639996892651252800307469400", "129392698179503764694933645772937614709" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e901bcb8af19416b65f5063a4af7996e5a51d7f" }, { "id": "CVE-2023-52854-21e0674a", "signature_type": "Line", "target": { "file": "kernel/padata.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "279570454526059000033870917128847285839", "310108989541595015145968043873039706991", "148164213784324680247347988989254177676", "288889855144388594895788332503958788908", "313203998478253391509443594594670120053", "60561605752047916195887268173511930909", "290993360979357164858688912862221444488", "132005734677639996892651252800307469400", "129392698179503764694933645772937614709" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275" }, { "id": "CVE-2023-52854-2ac4fae3", "signature_type": "Function", "target": { "file": "kernel/padata.c", "function": "padata_free_shell" }, "signature_version": "v1", "digest": { "length": 236.0, "function_hash": "38496666732383425767116365527652596505" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5" }, { "id": "CVE-2023-52854-5faa4a6e", "signature_type": "Line", "target": { "file": "kernel/padata.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "279570454526059000033870917128847285839", "310108989541595015145968043873039706991", "148164213784324680247347988989254177676", "288889855144388594895788332503958788908", "313203998478253391509443594594670120053", "60561605752047916195887268173511930909", "290993360979357164858688912862221444488", "132005734677639996892651252800307469400", "129392698179503764694933645772937614709" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1734a79e951914f1db2c65e635012a35db1c674b" }, { "id": "CVE-2023-52854-759f98bf", "signature_type": "Function", "target": { "file": "kernel/padata.c", "function": "padata_free_shell" }, "signature_version": "v1", "digest": { "length": 236.0, "function_hash": "38496666732383425767116365527652596505" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1734a79e951914f1db2c65e635012a35db1c674b" }, { "id": "CVE-2023-52854-82f186d4", "signature_type": "Function", "target": { "file": "kernel/padata.c", "function": "padata_free_shell" }, "signature_version": "v1", "digest": { "length": 236.0, "function_hash": "38496666732383425767116365527652596505" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@1e901bcb8af19416b65f5063a4af7996e5a51d7f" }, { "id": "CVE-2023-52854-ad526d0e", "signature_type": "Line", "target": { "file": "kernel/padata.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "279570454526059000033870917128847285839", "310108989541595015145968043873039706991", "148164213784324680247347988989254177676", "288889855144388594895788332503958788908", "313203998478253391509443594594670120053", "60561605752047916195887268173511930909", "290993360979357164858688912862221444488", "132005734677639996892651252800307469400", "129392698179503764694933645772937614709" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0dd34a7ad395dbcf6ae60e48e9786050e25b9bc5" }, { "id": "CVE-2023-52854-b0e62c7c", "signature_type": "Line", "target": { "file": "kernel/padata.c" }, "signature_version": "v1", "digest": { "line_hashes": [ "279570454526059000033870917128847285839", "310108989541595015145968043873039706991", "148164213784324680247347988989254177676", "288889855144388594895788332503958788908", "313203998478253391509443594594670120053", "60561605752047916195887268173511930909", "290993360979357164858688912862221444488", "132005734677639996892651252800307469400", "129392698179503764694933645772937614709" ], "threshold": 0.9 }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7ddc21e317b360c3444de3023bcc83b85fabae2f" }, { "id": "CVE-2023-52854-cdf07ba7", "signature_type": "Function", "target": { "file": "kernel/padata.c", "function": "padata_free_shell" }, "signature_version": "v1", "digest": { "length": 236.0, "function_hash": "38496666732383425767116365527652596505" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41aad9d6953984d134fc50f631f24ef476875d4d" }, { "id": "CVE-2023-52854-df986d00", "signature_type": "Function", "target": { "file": "kernel/padata.c", "function": "padata_free_shell" }, "signature_version": "v1", "digest": { "length": 236.0, "function_hash": "38496666732383425767116365527652596505" }, "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c7c26d0ef5d20f00dbb2ae3befcabbe0efa77275" } ] }