oss-security - Re: CVE request: Use-after-free in Linux kernel with aufs mmap patch

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 11 Sep 2015 04:44:06 +0900
From: sfjro@...rs.sourceforge.net
To: Ben Hutchings <ben@...adent.org.uk>
Cc: oss-security <oss-security@...ts.openwall.com>
Subject: Re: CVE request: Use-after-free in Linux kernel with aufs mmap patch


Ben Hutchings:
> The aufs (Advanced Union Filesystem) project provides an optional patch
> for the Linux kernel, called either aufs3-mmap.patch or
	:::
> I posted a patch here that works for me:
> http://sourceforge.net/p/aufs/mailman/message/34449209/
>
> Please assign a CVE ID to this.

I know this is a bug but I don't have time to fix it or test your patch.
I am afraid your patch may introduce another problem because you don't
handle vm_prfile. I still think get/put(vm_prfile) is necessary. Its
lifetime should be equivalent to vm_file's essentially. How about the
test case for the race condition between these?
- groupA: msync or madvise
- groupB: mmap and munmap

As you might know, aufs mmap/munmap handle vm_file and vm_prfile. When
aufs munmap calls fput(vm_prfile) and your patch doesn't
fget(vm_prfile), then vm_prfile will be broken. And I am afraid it will
cause a problem like use-after-free.

I have no objection to assign a CVE ID, but I don't think it is fixed or
at least I didn't confirmt yet.


J. R. Okajima

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.