Fix: UAF in crypto_run + limit allocation size in adjust_sg_array#104
Open
n4sm wants to merge 11 commits intocryptodev-linux:masterfrom
Open
Fix: UAF in crypto_run + limit allocation size in adjust_sg_array#104n4sm wants to merge 11 commits intocryptodev-linux:masterfrom
n4sm wants to merge 11 commits intocryptodev-linux:masterfrom
Conversation
… UAF we just need to crypt with a session and then start crypting again with src == NULL and dst == invalid, this will trigger the release_user_pages at the end of get_userbuf, causing a double free
…fferent hash states
…ue_work being shared among the cores, cryptask_routine might get executed by a different thread from the one which allocated the kernel_crypt_op, which leads to a UAF on the task and mm fields if thread A exits right after the queue_work in crypto_async_run
Author
|
Actually the UAF in My patch is actually wrong given |
…ists directly in cryptodev_hash_copy
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
crypto_run, whencrypto_runis called asynchronously the process which scheduled the task might get destroyed right after the async request, causing a UAF when__get_userbuftries to access the target pages. To me there might be a security concern, an attacker might use the UAF to gain access to the address space of a privileged process allowing an arbitrary read / write primitive.adjust_sg_arrayby restricting the allocation size to 2^10 pages.