"value":"In the Linux kernel, the following vulnerability has been resolved:\n\nuprobe: avoid out-of-bounds memory access of fetching args\n\nUprobe needs to fetch args into a percpu buffer, and then copy to ring\nbuffer to avoid non-atomic context problem.\n\nSometimes user-space strings, arrays can be very large, but the size of\npercpu buffer is only page size. And store_trace_args() won't check\nwhether these data exceeds a single page or not, caused out-of-bounds\nmemory access.\n\nIt could be reproduced by following steps:\n1. build kernel with CONFIG_KASAN enabled\n2. save follow program as test.c\n\n```\n\\#include <stdio.h>\n\\#include <stdlib.h>\n\\#include <string.h>\n\n// If string length large than MAX_STRING_SIZE, the fetch_store_strlen()\n// will return 0, cause __get_data_size() return shorter size, and\n// store_trace_args() will not trigger out-of-bounds access.\n// So make string length less than 4096.\n\\#define STRLEN 4093\n\nvoid generate_string(char *str, int n)\n{\n int i;\n for (i = 0; i < n; ++i)\n {\n char c = i % 26 + 'a';\n str[i] = c;\n }\n str[n-1] = '\\0';\n}\n\nvoid print_string(char *str)\n{\n printf(\"%s\\n\", str);\n}\n\nint main()\n{\n char tmp[STRLEN];\n\n generate_string(tmp, STRLEN);\n print_string(tmp);\n\n return 0;\n}\n```\n3. compile program\n`gcc -o test test.c`\n\n4. get the offset of `print_string()`\n```\nobjdump -t test | grep -w print_string\n0000000000401199 g F .text 000000000000001b print_string\n```\n\n5. configure uprobe with offset 0x1199\n```\noff=0x1199\n\ncd /sys/kernel/debug/tracing/\necho \"p /root/test:${off} arg1=+0(%di):ustring arg2=\\$comm arg3=+0(%di):ustring\"\n>uprobe_events\necho1>events/uprobes/enable\necho1>tracing_on\n```\n\n6.run`test`,andkasanwillreporterror.\n==================================================================\nBUG:KASAN:use-after-freeinstrncpy_from_user+0x1d6/0x1f0\nWriteofsize8ataddrffff88812311c004bytasktest/499CPU:0UID:0PID:499Comm:testNottainted6.12.0-rc3+#18\nHardwarename:RedHatKVM,BIOS1.16.0-4.al804/01/2014\nCallTrace:\n<TASK>\ndump_stack_lvl+0x55/0x70\nprint_address_description.constprop.0+0x27/0x310\nkasan_report+0x10f/0x120\n?strncpy_from_user+0x1d6/0x1f0\nstrncpy_from_user+0x1d6/0x1f0\n?rmqueue.constprop.0+0x70d/0x2ad0\nprocess_fetch_insn+0xb26/0x1470\n?__pfx_process_fetch_insn+0x10/0x10\n?_raw_spin_lock+0x85/0xe0\n?__pfx__raw_spin_lock+0x10/0x10\n?__pte_offset_map+0x1f/0x2d0\n?unwind_next_frame+0xc5f/0x1f80\n?arch_stack_walk+0x68/0xf0\n?is_bpf_text_address+0x23/0x30\n?kernel_text_address.part.0+0xbb/0xd0\n?__kernel_text_address+0x66/0xb0\n?unwind_get_return_address+0x5e/0xa0\n?__pfx_stack_trace_consume_entry+0x10/0x10\n?arch_stack_walk+0xa2/0xf0\n?_raw_spin_lock_irqsave+0x8b/0xf0\n?__pfx__raw_spin_lock_irqsave+0x10/0x10\n?depot_alloc_stack+0x4c/0x1f0\n?_raw_spin_unlock_irqrestore+0xe/0x30\n?stack_depot_save_flags+0x35d/0x4f0\n?kasan_save_stack+0x34/0x50\n?kasan_save_stack+0x24/0x50\n?mutex_lock+0x91/0xe0\n?__pfx_mutex_lock+0x10/0x10\nprepare_uprobe_buffer.part.0+0x2cd/0x500\nuprobe_dispatcher+0x2c3/0x6a0\n?__pfx_uprobe_dispatcher+0x10/0x10\n?__kasan_slab_alloc+0x4d/0x90\nhandler_chain+0xdd/0x3e0\nhandle_swbp+0x26e/0x3d0\n?__pfx_handle_swbp+0x10/0x10\n?uprobe_pre_sstep_notifier+0x151/0x1b0\nirqentry_exit_to_user_mode+0xe2/0x1b0\nasm_exc_int3+0x39/0x40\nRIP:0033:0x401199\nCode:01c20fb645fb88028345fc018b45fc3b45e47cb78b45e44898488d50ff488b45e84801d0ce\nRSP:002b:00007ffdf00576a8EFLAGS:00000206\nRAX:00007ffdf00576b0RBX:0000000000000000RCX:0000000000000ff2\nRDX:0000000000000ffcRSI:0000000000000ffdRDI:00007ffdf00576b0\nRBP:00007ffdf00586b0R08:00007feb2f9c0d20R09:00007feb2f9c0d20\nR10:0000000000000001R11:0000000000000202R12:0000000000401040\nR13:00007ffdf0058780R14:0000000000000000R15:0000000000000000\n</TASK>\n\nThiscommitenforcesthebuffer'smaxlenlessthanapage-sizetoavoid
"value":"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: uprobe: evitar el acceso a memoria fuera de los l\u00edmites para obtener argumentos. Uprobe necesita obtener argumentos en un b\u00fafer por CPU y luego copiarlos en el b\u00fafer de anillo para evitar problemas de contexto no at\u00f3mico. A veces, las cadenas y matrices del espacio de usuario pueden ser muy grandes, pero el tama\u00f1o del b\u00fafer por CPU es solo el tama\u00f1o de la p\u00e1gina. Y store_trace_args() no verificar\u00e1 si estos datos exceden una sola p\u00e1gina o no, lo que provoc\u00f3 un acceso a memoria fuera de los l\u00edmites. Se puede reproducir siguiendo los pasos: 1. compilar el kernel con CONFIG_KASAN habilitado 2. guardar el siguiente programa como test.c ``` \\#include \\#include \\#include // Si la longitud de la cadena es mayor que MAX_STRING_SIZE, fetch_store_strlen() // devolver\u00e1 0, lo que har\u00e1 que __get_data_size() devuelva un tama\u00f1o menor y // store_trace_args() no active el acceso fuera de los l\u00edmites. // Entonces haga que la longitud de la cadena sea menor que 4096. \\#define STRLEN 4093 void generate_string(char *str, int n) { int i; for (i = 0; i < n; ++i) { char c = i % 26 + 'a'; str[i] = c; } str[n-1] = '\\0'; } void print_string(char *str) { printf(\"%s\\n\", str); } int main() { char tmp[STRLEN]; generate_string(tmp, STRLEN); print_string(tmp); return 0; } ``` 3. compilar el programa `gcc -o test test.c` 4. obtener el desplazamiento de `print_string()` ``` objdump -t test | grep -w print_string 0000000000401199 g F .text 000000000000001b print_string ``` 5. configure uprobe con desplazamiento 0x1199 ``` off=0x1199 cd /sys/kernel/debug/tracing/ echo \"p /root/test:${off} arg1=+0(%di):ustring arg2=\\$comm arg3=+0(%di):ustring\">uprobe_eventsecho1>events/uprobes/enableecho1>tracing_on```6.ejecute`test`ykasaninformar\u00e1elerror.=====================================================================ERROR:KASAN:use-after-freeenstrncpy_from_user+0x1d6/0x1f0Escrituradetama\u00f1o8enladirecci\u00f3nffff88812311c004porlatareatest/499CPU:0UID:0PID:499Comm:testNocontaminado6.12.0-rc3+#18Nombredelhardware:RedHatKVM,BIOS1.16.0-4.al801/04/2014Rastreodellamadas:dump_stack_lvl+0x55/0x70descripci\u00f3n_direcci\u00f3n_impresi\u00f3n.constprop.0+0x27/0x310informe_kasan+0x10f/0x120?strncpy_desde_usuario+0x1d6/0x1f0strncpy_desde_usuario+0x1d6/0x1f0?rmqueue.constprop.0+0x70d/0x2ad0inserci\u00f3n_obtenci\u00f3n_proceso+0xb26/0x1470?__pfx_instrucci\u00f3n_obtenci\u00f3n_proceso+0x10/0x10?_bloqueo_giro_sin_procesamiento+0x85/0xe0?__pfx__bloqueo_giro_sin_procesamiento+0x10/0x10?__pte_offset_map+0x1f/0x2d0?desenrollar_siguiente_fotograma+0xc5f/0x1f80?arch_stack_walk+0x68/0xf0?is_bpf_text_address+0x23/0x30?kernel_text_address.part.0+0xbb/0xd0?__kernel_text_address+0x66/0xb0?unwind_get_return_address+0x5e/0xa0?__pfx_stack_trace_consume_entry+0x10/0x10?arch_stack_walk+0xa2/0xf0?_raw_spin_lock_irqsave+0x8b/0xf0?__pfx__raw_spin_lock_irqsave+0x10/0x10?depot_alloc_stack+0x4c/0x1f0?__pfx_uprobe_dispatcher+0x10/0x10?__kasan_slab_alloc+0x4d/0x90handler_chain+0xdd/0x3e0handle_swbp+0x26e/0x3d0?__pfx_handle_swbp+0x10/0x10?uprobe_pre_sstep_notifier+0x151/0x1b0irqentry_exit_to_user_mode+0xe2/0x1b0asm_exc_int3+0x39/0x40RIP:0033:0x401199C\u00f3digo:01c20fb645fb88028345fc018b45fc3b45e47cb78b45e44898488d50ff488b45e84801d0ceRSP:002b:00007ffdf00576a8EFLAGS:00000206RAX:00007ffdf00576b0RBX:0000000000000000RCX:0000000000000ff2RDX:0000000000000ffcRSI:0000000000000ffdRDI:00007ffdf00576b0RBP:00007ffdf00586b0R08:00007feb2f9c0d20R09:00007feb2f9c0d20R10:000000000000001R11:0000000000000202R12:0000000000401040R13:00007ffdf0058780R14:00000000000000000R15:0000000000000000Estaconfirmaci\u00f3nhacequelalongitudm\u00e1ximadelb\u00faferseamenorqueeltama\u00f1odeunap\u00e1ginaparaevitarelaccesofueradememoriaast
