mirror of
https://github.com/0xMarcio/cve.git
synced 2025-11-28 18:48:49 +00:00
18 lines
2.7 KiB
Markdown
18 lines
2.7 KiB
Markdown
|
### [CVE-2024-56693](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-56693)
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
|
||
|
|
### Description
|
||
|
|
|
||
|
|
In the Linux kernel, the following vulnerability has been resolved:brd: defer automatic disk creation until module initialization succeedsMy colleague Wupeng found the following problems during fault injection:BUG: unable to handle page fault for address: fffffbfff809d073PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTICPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS1.16.1-2.fc37 04/01/2014RIP: 0010:__asan_load8+0x4c/0xa0...Call Trace: <TASK> blkdev_put_whole+0x41/0x70 bdev_release+0x1a3/0x250 blkdev_release+0x11/0x20 __fput+0x1d7/0x4a0 task_work_run+0xfc/0x180 syscall_exit_to_user_mode+0x1de/0x1f0 do_syscall_64+0x6b/0x170 entry_SYSCALL_64_after_hwframe+0x76/0x7eloop_init() is calling loop_add() after __register_blkdev() succeeds andis ignoring disk_add() failure from loop_add(), for loop_add() failureis not fatal and successfully created disks are already visible tobdev_open().brd_init() is currently calling brd_alloc() before __register_blkdev()succeeds and is releasing successfully created disks when brd_init()returns an error. This can cause UAF for the latter two case:case 1: T1:modprobe brd brd_init brd_alloc(0) // success add_disk disk_scan_partitions bdev_file_open_by_dev // alloc file fput // won't free until back to userspace brd_alloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace __fput blkdev_release bdev_release blkdev_put_whole bdev->bd_disk->fops->release // fops is freed now, UAF!case 2: T1: T2:modprobe brd brd_init brd_alloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe close(/dev/ram0) ... /* UAF! */ bdev->bd_disk->fops->releaseFix this problem by following what loop_init() does. Besides,reintroduce brd_devices_mutex to help serialize modifications tobrd_list.
|
||
|
|
|
||
|
|
### POC
|
||
|
|
|
||
|
|
#### Reference
|
||
|
|
No PoCs from references.
|
||
|
|
|
||
|
|
#### Github
|
||
|
|
- https://github.com/cku-heise/euvd-api-doc
|
||
|
|
|