Introduction

Diese Schwachstelle ist eine Race-Condition-Schwachstelle, die in drivers/media/dvb-core/dmxdev.c auftritt. Daher kann eine Race-Condition in dem USB-Gerätetreiber auftreten, der dieses dmxdev verwendet.

Diese Schwachstelle könnte verwendet werden, um 3 UAFs auszulösen.

Vulnerability

1. vmalloc UAF write

Zuerst ist die Reihenfolge des Exploits wie folgt(I habe mit drivers/media/usb/ttusb-dec/ttusb_dec.c debuggt):``` cpu0 cpu1 cpu 2 1. dvb_dvr_open() 2. ttusb_dec_disconnect() ttusb_dec_exit_dvb() dvb_dmxdev_release() wait_event(dmxdev->dvr_dvbdev->wait_queue, …) 3. dvb_demux_open() dvb_demux_ioctl() dvb_usercopy() copy_from_user() <- userfaultfd stuck 4. dvb_dvr_release() 5. vfree(dmxdev->filter) 6. copy_from_user() <- userfaultfd release dvb_demux_do_ioctl() struct dmxdev *dmxdev = dmxdevfilter->dev; <- UAF!!

Der detaillierte Exploit-Ablauf ist wie folgt:

1. Öffnen Sie dvr0 unter den Geräteknoten. Dies führt dazu, dass dvb_dvr_open() aufgerufen wird, um `dvbdev->users++` auszuführen.
In diesem Fall wird bei Ausführung von ttusb_dec_disconnect() durch Entfernen des USB-Geräts die Bedingung `wait_event(dmxdev->dvr_dvbdev->wait_queue, …)` abgefangen.

2. Entfernen Sie das USB-Gerät physisch.
In diesem Fall wartet es bei der Ausführung der Funktion ttusb_dec_disconnect() auf `wait_event(dmxdev->dvr_dvbdev->wait_queue, …)`.

3. Öffnen Sie den demux0-Knoten, sodass die Funktion dvb_demux_open() aufgerufen wird.
Diese Funktion führt ebenfalls `dvbdev->users++` aus, ähnlich wie die Funktion dvb_dvr_open() in Schritt 1.
Allerdings tritt diese fehlerhafte Referenzzählung auf, weil die derzeit wartende Funktion dvb_dmxdev_release() die Prüfung auf `dvbdev->users` bereits bestanden hat:```
void dvb_dmxdev_release(struct dmxdev *dmxdev)
{
        dmxdev->exit = 1;
        if (dmxdev->dvbdev->users > 1) {    // This check is bypassed. improper reference counting.
                wait_event(dmxdev->dvbdev->wait_queue,
                                dmxdev->dvbdev->users == 1);
        }
        if (dmxdev->dvr_dvbdev->users > 1) {
                wait_event(dmxdev->dvr_dvbdev->wait_queue,    // Currently wait()ing here.
                                dmxdev->dvr_dvbdev->users == 1);
        }

        dvb_unregister_device(dmxdev->dvbdev);
        dvb_unregister_device(dmxdev->dvr_dvbdev);

        vfree(dmxdev->filter);
        dmxdev->filter = NULL;
        dmxdev->demux->close(dmxdev->demux);
}

4. Schließen Sie den fd in dem Thread, der das dvr0-Node geöffnet hat. Dann wird `dvb_dvr_release()` aufgerufen, und `dvbdev->users--` sowie `wake_up(&dvbdev->wait_queue)` werden ausgeführt, um die Funktion `dvb_dmxdev_release()` zu wecken, die den .disconnect-Ablauf darstellt. 5. Im .disconnect-Ablauf, Funktion `dvb_dmxdev_release()`, wird `vfree(dmxdev->filter)` ausgeführt. 6. Geben Sie userfaultfd aus dem demux0-ioctl-Thread frei, der userfaultfd gesetzt hat. Dies führt zur UAF, indem die `dmxdev->filter`-Adresse gelesen wird, die Sie gerade aus .disconnect freigegeben haben. UAF kann nun in allen Fällen von `dvb_demux_do_ioctl()` genutzt werden, und sogar LPE ist möglich, wenn es mit eBPF kombiniert wird. Das Kernel-Log sieht wie folgt aus:``` [ 83.990720] BUG: unable to handle page fault for address: ffffc900013c5060 [ 83.990733] #PF: supervisor read access in kernel mode [ 83.990739] #PF: error_code(0x0000) - not-present page [ 83.990744] PGD 100000067 P4D 100000067 PUD 1001dd067 PMD 1078fc067 PTE 0 [ 83.990760] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 83.990768] CPU: 2 PID: 2580 Comm: exploit Not tainted 6.0.0-rc2+ #3 [ 83.990776] Hardware name: Gigabyte Technology Co., Ltd. B460MDS3H/B460M DS3H, BIOS F3 05/27/2020 [ 83.990781] RIP: 0010:dvb_demux_do_ioctl+0x22/0x5b0 [dvb_core] [ 83.990809] Code: 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 55 48 89 e5 41 57 49 89 d7 41 56 41 55 41 54 53 89 f3 48 84 [ 83.990816] RSP: 0018:ffffc90001a3fd10 EFLAGS: 00010282 [ 83.990824] RAX: 0000000000000000 RBX: 00000000403c6f2b RCX: ffffffffc051c520 [ 83.990830] RDX: ffffc90001a3fd80 RSI: 00000000403c6f2b RDI: ffff88810c4adc00 [ 83.990835] RBP: ffffc90001a3fd58 R08: 0000000000000000 R09: 0000000000000000 [ 83.990840] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff2 [ 83.990845] R13: ffffc900013c5000 R14: ffff88810c4adc00 R15: ffffc90001a3fd80 [ 83.990850] FS: 00007f0c4fdd7640(0000) GS:ffff88844ea80000(0000) knlGS:0000000000000000 [ 83.990857] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.990863] CR2: ffffc900013c5060 CR3: 000000010b31e001 CR4: 00000000007706e0 [ 83.990869] PKRU: 55555554 [ 83.990873] Call Trace: [ 83.990877] <TASK> [ 83.990886] dvb_usercopy+0x55/0x1a0 [dvb_core] [ 83.990907] ? dvb_dmxdev_filter_start+0x3b0/0x3b0 [dvb_core] [ 83.990932] dvb_demux_ioctl+0x15/0x20 [dvb_core] [ 83.990951] __x64_sys_ioctl+0x92/0xd0 [ 83.990965] do_syscall_64+0x59/0x90 [ 83.990973] ? debug_smp_processor_id+0x17/0x20 [ 83.990984] ? fpregs_assert_state_consistent+0x2a/0x50 [ 83.990995] ? exit_to_user_mode_prepare+0x49/0x1a0 [ 83.991007] ? syscall_exit_to_user_mode+0x26/0x50 [ 83.991016] ? __x64_sys_write+0x19/0x20 [ 83.991024] ? do_syscall_64+0x69/0x90 [ 83.991030] ? irqentry_exit_to_user_mode+0x9/0x20 [ 83.991039] ? irqentry_exit+0x3b/0x50 [ 83.991048] ? exc_page_fault+0x87/0x180 [ 83.991056] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 83.991068] RIP: 0033:0x454b7f [ 83.991075] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 40 [ 83.991081] RSP: 002b:00007f0c4fdd7150 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 83.991090] RAX: ffffffffffffffda RBX: 00007f0c4fdd7640 RCX: 0000000000454b7f [ 83.991095] RDX: 00007f0c50dda000 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 83.991100] RBP: 00007f0c4fdd71d0 R08: 0000000000000000 R09: 0000000000000000 [ 83.991104] R10: 000000000000000a R11: 0000000000000246 R12: 00007f0c4fdd7640 [ 83.991109] R13: 0000000000000000 R14: 000000000041ba00 R15: 00007f0c4f5d7000 [ 83.991118] </TASK> [ 83.991121] Modules linked in: snd_usb_audio usbhid hid snd_usbmidi_lib ttusb_dec ttusbdecfe dvb_core mc snd_sof_pca [ 83.991249] sysfillrect rapl sysimgblt snd intel_cstate mei_me soundcore ee1004 mei gigabyte_wmi wmi_bmof serial_mt [ 83.991333] CR2: ffffc900013c5060 [ 83.991339] ---[ end trace 0000000000000000 ]--- [ 83.991344] RIP: 0010:dvb_demux_do_ioctl+0x22/0x5b0 [dvb_core] [ 83.991366] Code: 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 55 48 89 e5 41 57 49 89 d7 41 56 41 55 41 54 53 89 f3 48 84 [ 83.991372] RSP: 0018:ffffc90001a3fd10 EFLAGS: 00010282 [ 83.991378] RAX: 0000000000000000 RBX: 00000000403c6f2b RCX: ffffffffc051c520 [ 83.991383] RDX: ffffc90001a3fd80 RSI: 00000000403c6f2b RDI: ffff88810c4adc00 [ 83.991387] RBP: ffffc90001a3fd58 R08: 0000000000000000 R09: 0000000000000000 [ 83.991392] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff2 [ 83.991396] R13: ffffc900013c5000 R14: ffff88810c4adc00 R15: ffffc90001a3fd80 [ 83.991401] FS: 00007f0c4fdd7640(0000) GS:ffff88844ea80000(0000) knlGS:0000000000000000 [ 83.991407] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.991412] CR2: ffffc900013c5060 CR3: 000000010b31e001 CR4: 00000000007706e0 [ 83.991417] PKRU: 55555554

In der obigen Funktion wird `filp->f_op->flush(filp, id);` aufgerufen, und es kommt zu UAF, da dieses `f_op` die fops sind, die in Schritt 5 per kfree() freigegeben wurden. Dies wird in Verbindung mit kmalloc Heap Spraying zu einer Schwachstelle, die jede beliebige Adresse ausführen kann. Hier ist das KASAN-Log:``` [ 708.982899] ================================================================== [ 708.982921] BUG: KASAN: use-after-free in filp_close+0x119/0x140 [ 708.982929] Read of size 8 at addr ffff888114bd4078 by task exploit2/2918 [ 708.982933] CPU: 7 PID: 2918 Comm: exploit2 Not tainted 6.0.0-rc2+ #4 [ 708.982936] Hardware name: Gigabyte Technology Co., Ltd. B460MDS3H/B460M DS3H, BIOS F3 05/27/2020 [ 708.982938] Call Trace: [ 708.982954] <TASK> [ 708.982956] dump_stack_lvl+0x49/0x63 [ 708.982960] print_report.cold+0x5e/0x5d9 [ 708.982963] ? filp_close+0x119/0x140 [ 708.982966] kasan_report+0xa0/0x120 [ 708.982969] ? filp_close+0x119/0x140 [ 708.982972] __asan_report_load8_noabort+0x14/0x20 [ 708.982975] filp_close+0x119/0x140 [ 708.982978] close_fd+0x75/0x90 [ 708.982981] __x64_sys_close+0x30/0x80 [ 708.982984] do_syscall_64+0x59/0x90 [ 708.982987] ? syscall_exit_to_user_mode+0x26/0x50 [ 708.982990] ? do_syscall_64+0x69/0x90 [ 708.982994] ? syscall_exit_to_user_mode+0x26/0x50 [ 708.983017] ? __do_sys_gettid+0x1b/0x30 [ 708.983022] ? do_syscall_64+0x69/0x90 [ 708.983027] ? exit_to_user_mode_prepare+0x49/0x1a0 [ 708.983035] ? irqentry_exit_to_user_mode+0x9/0x20 [ 708.983041] ? irqentry_exit+0x3b/0x50 [ 708.983045] ? exc_page_fault+0x72/0xf0 [ 708.983050] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 708.983072] RIP: 0033:0x45396b [ 708.983077] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 33 a9 02 00 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 81 a9 02 00 8b 44 [ 708.983081] RSP: 002b:00007f55128b41a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 708.983087] RAX: ffffffffffffffda RBX: 00007f55128b4640 RCX: 000000000045396b [ 708.983091] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 708.983094] RBP: 00007f55128b41d0 R08: 0000000000000000 R09: 0000000000000000 [ 708.983097] R10: 0000000000000000 R11: 0000000000000293 R12: 00007f55128b4640 [ 708.983100] R13: 0000000000000000 R14: 000000000041b3e0 R15: 00007f55120b4000 [ 708.983107] </TASK> [ 708.983130] Allocated by task 663: [ 708.983133] kasan_save_stack+0x26/0x50 [ 708.983137] __kasan_kmalloc+0xae/0xe0 [ 708.983140] __kmalloc_node+0x185/0x420 [ 708.983145] memcg_alloc_slab_cgroups+0x8a/0x130 [ 708.983149] allocate_slab+0x389/0x4a0 [ 708.983152] ___slab_alloc+0x6c5/0xa50 [ 708.983155] __slab_alloc.constprop.0+0x5a/0xb0 [ 708.983159] kmem_cache_alloc+0x2e3/0x320 [ 708.983162] seq_open+0x57/0x160 [ 708.983166] kernfs_fop_open+0x4f0/0xc10 [ 708.983171] do_dentry_open+0x404/0xf80 [ 708.983174] vfs_open+0x9f/0xd0 [ 708.983177] path_openat+0xd58/0x3f60 [ 708.983181] do_filp_open+0x1b1/0x3e0 [ 708.983184] do_sys_openat2+0x132/0x450 [ 708.983187] __x64_sys_openat+0x128/0x210 [ 708.983191] do_syscall_64+0x59/0x90 [ 708.983194] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 708.983201] Freed by task 159: [ 708.983204] kasan_save_stack+0x26/0x50 [ 708.983207] kasan_set_track+0x25/0x40 [ 708.983211] kasan_set_free_info+0x24/0x40 [ 708.983215] ____kasan_slab_free+0x176/0x1e0 [ 708.983218] __kasan_slab_free+0x12/0x20 [ 708.983221] slab_free_freelist_hook+0xd0/0x1a0 [ 708.983224] kfree+0x1ae/0x3e0 [ 708.983227] dvb_free_device.part.0+0x33/0x70 [dvb_core] [ 708.983241] dvb_unregister_device+0x20/0x30 [dvb_core] [ 708.983248] dvb_dmxdev_release+0x3ba/0x4e3 [dvb_core] [ 708.983255] ttusb_dec_disconnect+0x3d8/0x499 [ttusb_dec] [ 708.983258] usb_unbind_interface+0x187/0x7c0 [ 708.983261] device_remove+0x117/0x170 [ 708.983264] device_release_driver_internal+0x418/0x660 [ 708.983266] device_release_driver+0x12/0x20 [ 708.983268] bus_remove_device+0x28f/0x540 [ 708.983270] device_del+0x501/0xc30 [ 708.983273] usb_disable_device+0x2a5/0x660 [ 708.983274] usb_disconnect.cold+0x1f9/0x620 [ 708.983277] hub_event+0x16d3/0x3d20 [ 708.983280] process_one_work+0x778/0x11c0 [ 708.983283] worker_thread+0x544/0x1180 [ 708.983285] kthread+0x280/0x320 [ 708.983286] ret_from_fork+0x1f/0x30 [ 708.983291] The buggy address belongs to the object at ffff888114bd4000 which belongs to the cache kmalloc-512 of size 512 [ 708.983293] The buggy address is located 120 bytes inside of 512-byte region [ffff888114bd4000, ffff888114bd4200) [ 708.983297] The buggy address belongs to the physical page: [ 708.983298] page:000000009b45bbf6 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114bd0 [ 708.983301] head:000000009b45bbf6 order:3 compound_mapcount:0 compound_pincount:0 [ 708.983303] flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) [ 708.983307] raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100042c80 [ 708.983309] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 708.983311] page dumped because: kasan: bad access detected [ 708.983313] Memory state around the buggy address: [ 708.983314] ffff888114bd3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 708.983316] ffff888114bd3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 708.983318] >ffff888114bd4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 708.983320] ^ [ 708.983321] ffff888114bd4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 708.983323] ffff888114bd4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 708.983325] ================================================================== [ 708.983336] Disabling lock debugging due to kernel taint

Dieses UAF-Schreibschwachstelle kann beispielsweise dazu genutzt werden, den Referenzzähler einer anderen Struktur zu dekrementieren. # Schwachstellenumfang Der Umfang dieser Schwachstelle umfasst: - drivers/media/usb/as102/as102_usb_drv.c - drivers/media/usb/tm6000/tm6000-cards.c - drivers/media/usb/pvrusb2/pvrusb2-dvb.c - drivers/media/usb/au0828/au0828-core.c - drivers/media/usb/cx231xx/cx231xx-cards.c - drivers/media/usb/ttusb-dec/ttusb_dec.c - drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c - drivers/media/usb/em28xx/em28xx-dvb.c - drivers/media/usb/dvb-usb/cxusb.c - drivers/media/usb/dvb-usb/dw2102.c - drivers/media/usb/dvb-usb/dtt200u.c - drivers/media/usb/dvb-usb/m920x.c - drivers/media/usb/dvb-usb/dibusb-mb.c - drivers/media/usb/dvb-usb/ttusb2.c - drivers/media/usb/dvb-usb/pctv452e.c - drivers/media/usb/dvb-usb/a800.c - drivers/media/usb/dvb-usb/umt-010.c - drivers/media/usb/dvb-usb/dtv5100.c - drivers/media/usb/dvb-usb/dibusb-mc.c - drivers/media/usb/dvb-usb/cinergyT2-core.c - drivers/media/usb/dvb-usb/nova-t-usb2.c - drivers/media/usb/dvb-usb/vp7045.c - drivers/media/usb/dvb-usb/digitv.c - drivers/media/usb/dvb-usb/gp8psk.c - drivers/media/usb/dvb-usb/vp702x.c - drivers/media/usb/dvb-usb/opera1.c - drivers/media/usb/dvb-usb/technisat-usb2.c - drivers/media/usb/dvb-usb/dib0700_core.c - drivers/media/usb/dvb-usb/az6027.c - drivers/media/usb/dvb-usb/af9005.c - drivers/media/usb/dvb-usb-v2/au6610.c - drivers/media/usb/dvb-usb-v2/zd1301.c - drivers/media/usb/dvb-usb-v2/ce6230.c - drivers/media/usb/dvb-usb-v2/ec168.c - drivers/media/usb/dvb-usb-v2/gl861.c - drivers/media/usb/dvb-usb-v2/dvbsky.c - drivers/media/usb/dvb-usb-v2/az6007.c - drivers/media/usb/dvb-usb-v2/lmedm04.c - drivers/media/usb/dvb-usb-v2/anysee.c - drivers/media/usb/dvb-usb-v2/mxl111sf.c - drivers/media/usb/dvb-usb-v2/af9015.c - drivers/media/usb/dvb-usb-v2/rtl28xxu.c - drivers/media/usb/dvb-usb-v2/af9035.c - ... # Referenz - https://lore.kernel.org/all/[email protected]/ - https://www.suse.com/security/cve/CVE-2022-41218.html - https://www.openwall.com/lists/oss-security/2022/09/24/1

CVE-2022-41218

Beliebteste

2. UAF, der die Ausführung an einer beliebigen Adresse ermöglicht

3. slab UAF write