はじめに

本脆弱性は、drivers/media/dvb-core/dmxdev.c に存在する競合状態の脆弱性です。そのため、この dmxdev を使用する usb デバイスドライバでは競合状態が発生する可能性があります。

この脆弱性は、3つの UAF を引き起こすために使用される可能性があります。

脆弱性

1. vmalloc UAF 書き込み

まず、エクスプロイトの順序は次のとおりです（drivers/media/usb/ttusb-dec/ttusb_dec.c を使用してデバッグしました）：``` cpu0 cpu1 cpu 2 1. dvb_dvr_open() 2. ttusb_dec_disconnect() ttusb_dec_exit_dvb() dvb_dmxdev_release() wait_event(dmxdev->dvr_dvbdev->wait_queue, …) 3. dvb_demux_open() dvb_demux_ioctl() dvb_usercopy() copy_from_user() <- userfaultfd stuck 4. dvb_dvr_release() 5. vfree(dmxdev->filter) 6. copy_from_user() <- userfaultfd release dvb_demux_do_ioctl() struct dmxdev *dmxdev = dmxdevfilter->dev; <- UAF!!

詳細なエクスプロイトの流れは以下の通りです。

1. デバイスノードの中で `dvr0` を `open()` します。これにより `dvb_dvr_open()` が呼び出され、`dvbdev->users++` が実行されます。
この場合、USBデバイスの取り外しによって `ttusb_dec_disconnect()` が実行されると、`wait_event(dmxdev->dvr_dvbdev->wait_queue, …)` の条件が捕捉されます。

2. USBデバイスを物理的に取り外します。
この場合、`ttusb_dec_disconnect()` 関数の実行中に、`wait_event(dmxdev->dvr_dvbdev->wait_queue, …)` で待機します。

3. `demux0` ノードを `open()` して、`dvb_demux_open()` 関数を呼び出します。
この関数も、ステップ1の `dvb_dvr_open()` 関数と同様に `dvbdev->users++` を実行します。
しかし、この不適切な参照カウントが発生するのは、現在待機中の `dvb_dmxdev_release()` 関数が `dvbdev->users` のチェックをすでに通過しているためです。```
void dvb_dmxdev_release(struct dmxdev *dmxdev)
{
        dmxdev->exit = 1;
        if (dmxdev->dvbdev->users > 1) {    // This check is bypassed. improper reference counting.
                wait_event(dmxdev->dvbdev->wait_queue,
                                dmxdev->dvbdev->users == 1);
        }
        if (dmxdev->dvr_dvbdev->users > 1) {
                wait_event(dmxdev->dvr_dvbdev->wait_queue,    // Currently wait()ing here.
                                dmxdev->dvr_dvbdev->users == 1);
        }

        dvb_unregister_device(dmxdev->dvbdev);
        dvb_unregister_device(dmxdev->dvr_dvbdev);

        vfree(dmxdev->filter);
        dmxdev->filter = NULL;
        dmxdev->demux->close(dmxdev->demux);
}

4. dvr0ノードをopen()したスレッドでそのfdをclose()します。するとdvb_dvr_release()が呼び出され、`dvbdev->users--`と`wake_up(&dvbdev->wait_queue)`が実行されて、.disconnectフローであるdvb_dmxdev_release()関数を起床させます。 5. .disconnectフローでは、dvb_dmxdev_release()関数内で`vfree(dmxdev->filter)`が実行されます。 6. userfaultfdを設定したdemux0 ioctlスレッドからuserfaultfdを解放します。これにより、.disconnectで解放したばかりの`dmxdev->filter`アドレスを読み取ることでUAFが発生します。これでUAFはdvb_demux_do_ioctl()のすべてのケースで利用可能になり、eBPFと組み合わせればLPEも可能です。カーネルログは次のようになります。``` [ 83.990720] BUG: unable to handle page fault for address: ffffc900013c5060 [ 83.990733] #PF: supervisor read access in kernel mode [ 83.990739] #PF: error_code(0x0000) - not-present page [ 83.990744] PGD 100000067 P4D 100000067 PUD 1001dd067 PMD 1078fc067 PTE 0 [ 83.990760] Oops: 0000 [#1] PREEMPT SMP NOPTI [ 83.990768] CPU: 2 PID: 2580 Comm: exploit Not tainted 6.0.0-rc2+ #3 [ 83.990776] Hardware name: Gigabyte Technology Co., Ltd. B460MDS3H/B460M DS3H, BIOS F3 05/27/2020 [ 83.990781] RIP: 0010:dvb_demux_do_ioctl+0x22/0x5b0 [dvb_core] [ 83.990809] Code: 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 55 48 89 e5 41 57 49 89 d7 41 56 41 55 41 54 53 89 f3 48 84 [ 83.990816] RSP: 0018:ffffc90001a3fd10 EFLAGS: 00010282 [ 83.990824] RAX: 0000000000000000 RBX: 00000000403c6f2b RCX: ffffffffc051c520 [ 83.990830] RDX: ffffc90001a3fd80 RSI: 00000000403c6f2b RDI: ffff88810c4adc00 [ 83.990835] RBP: ffffc90001a3fd58 R08: 0000000000000000 R09: 0000000000000000 [ 83.990840] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff2 [ 83.990845] R13: ffffc900013c5000 R14: ffff88810c4adc00 R15: ffffc90001a3fd80 [ 83.990850] FS: 00007f0c4fdd7640(0000) GS:ffff88844ea80000(0000) knlGS:0000000000000000 [ 83.990857] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.990863] CR2: ffffc900013c5060 CR3: 000000010b31e001 CR4: 00000000007706e0 [ 83.990869] PKRU: 55555554 [ 83.990873] Call Trace: [ 83.990877] <TASK> [ 83.990886] dvb_usercopy+0x55/0x1a0 [dvb_core] [ 83.990907] ? dvb_dmxdev_filter_start+0x3b0/0x3b0 [dvb_core] [ 83.990932] dvb_demux_ioctl+0x15/0x20 [dvb_core] [ 83.990951] __x64_sys_ioctl+0x92/0xd0 [ 83.990965] do_syscall_64+0x59/0x90 [ 83.990973] ? debug_smp_processor_id+0x17/0x20 [ 83.990984] ? fpregs_assert_state_consistent+0x2a/0x50 [ 83.990995] ? exit_to_user_mode_prepare+0x49/0x1a0 [ 83.991007] ? syscall_exit_to_user_mode+0x26/0x50 [ 83.991016] ? __x64_sys_write+0x19/0x20 [ 83.991024] ? do_syscall_64+0x69/0x90 [ 83.991030] ? irqentry_exit_to_user_mode+0x9/0x20 [ 83.991039] ? irqentry_exit+0x3b/0x50 [ 83.991048] ? exc_page_fault+0x87/0x180 [ 83.991056] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 83.991068] RIP: 0033:0x454b7f [ 83.991075] Code: 00 48 89 44 24 18 31 c0 48 8d 44 24 60 c7 04 24 10 00 00 00 48 89 44 24 08 48 8d 44 24 20 48 89 40 [ 83.991081] RSP: 002b:00007f0c4fdd7150 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 83.991090] RAX: ffffffffffffffda RBX: 00007f0c4fdd7640 RCX: 0000000000454b7f [ 83.991095] RDX: 00007f0c50dda000 RSI: 00000000403c6f2b RDI: 0000000000000005 [ 83.991100] RBP: 00007f0c4fdd71d0 R08: 0000000000000000 R09: 0000000000000000 [ 83.991104] R10: 000000000000000a R11: 0000000000000246 R12: 00007f0c4fdd7640 [ 83.991109] R13: 0000000000000000 R14: 000000000041ba00 R15: 00007f0c4f5d7000 [ 83.991118] </TASK> [ 83.991121] Modules linked in: snd_usb_audio usbhid hid snd_usbmidi_lib ttusb_dec ttusbdecfe dvb_core mc snd_sof_pca [ 83.991249] sysfillrect rapl sysimgblt snd intel_cstate mei_me soundcore ee1004 mei gigabyte_wmi wmi_bmof serial_mt [ 83.991333] CR2: ffffc900013c5060 [ 83.991339] ---[ end trace 0000000000000000 ]--- [ 83.991344] RIP: 0010:dvb_demux_do_ioctl+0x22/0x5b0 [dvb_core] [ 83.991366] Code: 00 00 00 00 0f 1f 40 00 0f 1f 44 00 00 55 48 89 e5 41 57 49 89 d7 41 56 41 55 41 54 53 89 f3 48 84 [ 83.991372] RSP: 0018:ffffc90001a3fd10 EFLAGS: 00010282 [ 83.991378] RAX: 0000000000000000 RBX: 00000000403c6f2b RCX: ffffffffc051c520 [ 83.991383] RDX: ffffc90001a3fd80 RSI: 00000000403c6f2b RDI: ffff88810c4adc00 [ 83.991387] RBP: ffffc90001a3fd58 R08: 0000000000000000 R09: 0000000000000000 [ 83.991392] R10: 0000000000000000 R11: 0000000000000000 R12: 00000000fffffff2 [ 83.991396] R13: ffffc900013c5000 R14: ffff88810c4adc00 R15: ffffc90001a3fd80 [ 83.991401] FS: 00007f0c4fdd7640(0000) GS:ffff88844ea80000(0000) knlGS:0000000000000000 [ 83.991407] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 83.991412] CR2: ffffc900013c5060 CR3: 000000010b31e001 CR4: 00000000007706e0 [ 83.991417] PKRU: 55555554

上記の関数では、`filp->f_op->flush(filp, id);` が呼び出され、この `f_op` はステップ5でkfree()されたfopsであるため、UAFが発生します。これは、kmallocヒープスプレーと組み合わせることで、任意のアドレスを実行できる脆弱性になります。以下は KASAN ログです：``` [ 708.982899] ================================================================== [ 708.982921] BUG: KASAN: use-after-free in filp_close+0x119/0x140 [ 708.982929] Read of size 8 at addr ffff888114bd4078 by task exploit2/2918 [ 708.982933] CPU: 7 PID: 2918 Comm: exploit2 Not tainted 6.0.0-rc2+ #4 [ 708.982936] Hardware name: Gigabyte Technology Co., Ltd. B460MDS3H/B460M DS3H, BIOS F3 05/27/2020 [ 708.982938] Call Trace: [ 708.982954] <TASK> [ 708.982956] dump_stack_lvl+0x49/0x63 [ 708.982960] print_report.cold+0x5e/0x5d9 [ 708.982963] ? filp_close+0x119/0x140 [ 708.982966] kasan_report+0xa0/0x120 [ 708.982969] ? filp_close+0x119/0x140 [ 708.982972] __asan_report_load8_noabort+0x14/0x20 [ 708.982975] filp_close+0x119/0x140 [ 708.982978] close_fd+0x75/0x90 [ 708.982981] __x64_sys_close+0x30/0x80 [ 708.982984] do_syscall_64+0x59/0x90 [ 708.982987] ? syscall_exit_to_user_mode+0x26/0x50 [ 708.982990] ? do_syscall_64+0x69/0x90 [ 708.982994] ? syscall_exit_to_user_mode+0x26/0x50 [ 708.983017] ? __do_sys_gettid+0x1b/0x30 [ 708.983022] ? do_syscall_64+0x69/0x90 [ 708.983027] ? exit_to_user_mode_prepare+0x49/0x1a0 [ 708.983035] ? irqentry_exit_to_user_mode+0x9/0x20 [ 708.983041] ? irqentry_exit+0x3b/0x50 [ 708.983045] ? exc_page_fault+0x72/0xf0 [ 708.983050] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 708.983072] RIP: 0033:0x45396b [ 708.983077] Code: 03 00 00 00 0f 05 48 3d 00 f0 ff ff 77 41 c3 48 83 ec 18 89 7c 24 0c e8 33 a9 02 00 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 81 a9 02 00 8b 44 [ 708.983081] RSP: 002b:00007f55128b41a0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 [ 708.983087] RAX: ffffffffffffffda RBX: 00007f55128b4640 RCX: 000000000045396b [ 708.983091] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004 [ 708.983094] RBP: 00007f55128b41d0 R08: 0000000000000000 R09: 0000000000000000 [ 708.983097] R10: 0000000000000000 R11: 0000000000000293 R12: 00007f55128b4640 [ 708.983100] R13: 0000000000000000 R14: 000000000041b3e0 R15: 00007f55120b4000 [ 708.983107] </TASK> [ 708.983130] Allocated by task 663: [ 708.983133] kasan_save_stack+0x26/0x50 [ 708.983137] __kasan_kmalloc+0xae/0xe0 [ 708.983140] __kmalloc_node+0x185/0x420 [ 708.983145] memcg_alloc_slab_cgroups+0x8a/0x130 [ 708.983149] allocate_slab+0x389/0x4a0 [ 708.983152] ___slab_alloc+0x6c5/0xa50 [ 708.983155] __slab_alloc.constprop.0+0x5a/0xb0 [ 708.983159] kmem_cache_alloc+0x2e3/0x320 [ 708.983162] seq_open+0x57/0x160 [ 708.983166] kernfs_fop_open+0x4f0/0xc10 [ 708.983171] do_dentry_open+0x404/0xf80 [ 708.983174] vfs_open+0x9f/0xd0 [ 708.983177] path_openat+0xd58/0x3f60 [ 708.983181] do_filp_open+0x1b1/0x3e0 [ 708.983184] do_sys_openat2+0x132/0x450 [ 708.983187] __x64_sys_openat+0x128/0x210 [ 708.983191] do_syscall_64+0x59/0x90 [ 708.983194] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 708.983201] Freed by task 159: [ 708.983204] kasan_save_stack+0x26/0x50 [ 708.983207] kasan_set_track+0x25/0x40 [ 708.983211] kasan_set_free_info+0x24/0x40 [ 708.983215] ____kasan_slab_free+0x176/0x1e0 [ 708.983218] __kasan_slab_free+0x12/0x20 [ 708.983221] slab_free_freelist_hook+0xd0/0x1a0 [ 708.983224] kfree+0x1ae/0x3e0 [ 708.983227] dvb_free_device.part.0+0x33/0x70 [dvb_core] [ 708.983241] dvb_unregister_device+0x20/0x30 [dvb_core] [ 708.983248] dvb_dmxdev_release+0x3ba/0x4e3 [dvb_core] [ 708.983255] ttusb_dec_disconnect+0x3d8/0x499 [ttusb_dec] [ 708.983258] usb_unbind_interface+0x187/0x7c0 [ 708.983261] device_remove+0x117/0x170 [ 708.983264] device_release_driver_internal+0x418/0x660 [ 708.983266] device_release_driver+0x12/0x20 [ 708.983268] bus_remove_device+0x28f/0x540 [ 708.983270] device_del+0x501/0xc30 [ 708.983273] usb_disable_device+0x2a5/0x660 [ 708.983274] usb_disconnect.cold+0x1f9/0x620 [ 708.983277] hub_event+0x16d3/0x3d20 [ 708.983280] process_one_work+0x778/0x11c0 [ 708.983283] worker_thread+0x544/0x1180 [ 708.983285] kthread+0x280/0x320 [ 708.983286] ret_from_fork+0x1f/0x30 [ 708.983291] The buggy address belongs to the object at ffff888114bd4000 which belongs to the cache kmalloc-512 of size 512 [ 708.983293] The buggy address is located 120 bytes inside of 512-byte region [ffff888114bd4000, ffff888114bd4200) [ 708.983297] The buggy address belongs to the physical page: [ 708.983298] page:000000009b45bbf6 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114bd0 [ 708.983301] head:000000009b45bbf6 order:3 compound_mapcount:0 compound_pincount:0 [ 708.983303] flags: 0x17ffffc0010200(slab|head|node=0|zone=2|lastcpupid=0x1fffff) [ 708.983307] raw: 0017ffffc0010200 dead000000000100 dead000000000122 ffff888100042c80 [ 708.983309] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 708.983311] page dumped because: kasan: bad access detected [ 708.983313] Memory state around the buggy address: [ 708.983314] ffff888114bd3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 708.983316] ffff888114bd3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 708.983318] >ffff888114bd4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 708.983320] ^ [ 708.983321] ffff888114bd4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 708.983323] ffff888114bd4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 708.983325] ================================================================== [ 708.983336] Disabling lock debugging due to kernel taint

このUAF書き込みの脆弱性は、例えば、別の構造体の参照カウントを減らすために使用される可能性があります。 # 脆弱性の範囲この脆弱性の範囲は次のとおりです。 - drivers/media/usb/as102/as102_usb_drv.c - drivers/media/usb/tm6000/tm6000-cards.c - drivers/media/usb/pvrusb2/pvrusb2-dvb.c - drivers/media/usb/au0828/au0828-core.c - drivers/media/usb/cx231xx/cx231xx-cards.c - drivers/media/usb/ttusb-dec/ttusb_dec.c - drivers/media/usb/ttusb-budget/dvb-ttusb-budget.c - drivers/media/usb/em28xx/em28xx-dvb.c - drivers/media/usb/dvb-usb/cxusb.c - drivers/media/usb/dvb-usb/dw2102.c - drivers/media/usb/dvb-usb/dtt200u.c - drivers/media/usb/dvb-usb/m920x.c - drivers/media/usb/dvb-usb/dibusb-mb.c - drivers/media/usb/dvb-usb/ttusb2.c - drivers/media/usb/dvb-usb/pctv452e.c - drivers/media/usb/dvb-usb/a800.c - drivers/media/usb/dvb-usb/umt-010.c - drivers/media/usb/dvb-usb/dtv5100.c - drivers/media/usb/dvb-usb/dibusb-mc.c - drivers/media/usb/dvb-usb/cinergyT2-core.c - drivers/media/usb/dvb-usb/nova-t-usb2.c - drivers/media/usb/dvb-usb/vp7045.c - drivers/media/usb/dvb-usb/digitv.c - drivers/media/usb/dvb-usb/gp8psk.c - drivers/media/usb/dvb-usb/vp702x.c - drivers/media/usb/dvb-usb/opera1.c - drivers/media/usb/dvb-usb/technisat-usb2.c - drivers/media/usb/dvb-usb/dib0700_core.c - drivers/media/usb/dvb-usb/az6027.c - drivers/media/usb/dvb-usb/af9005.c - drivers/media/usb/dvb-usb-v2/au6610.c - drivers/media/usb/dvb-usb-v2/zd1301.c - drivers/media/usb/dvb-usb-v2/ce6230.c - drivers/media/usb/dvb-usb-v2/ec168.c - drivers/media/usb/dvb-usb-v2/gl861.c - drivers/media/usb/dvb-usb-v2/dvbsky.c - drivers/media/usb/dvb-usb-v2/az6007.c - drivers/media/usb/dvb-usb-v2/lmedm04.c - drivers/media/usb/dvb-usb-v2/anysee.c - drivers/media/usb/dvb-usb-v2/mxl111sf.c - drivers/media/usb/dvb-usb-v2/af9015.c - drivers/media/usb/dvb-usb-v2/rtl28xxu.c - drivers/media/usb/dvb-usb-v2/af9035.c - ... # 参照 - https://lore.kernel.org/all/[email protected]/ - https://www.suse.com/security/cve/CVE-2022-41218.html - https://www.openwall.com/lists/oss-security/2022/09/24/1

CVE-2022-41218

人気

2. 任意のアドレス実行を可能にするUAF

3. slab UAF write