Date: Fri, 5 Feb 2021 00:43:31 +0300 From: Alexander Popov <alex.popov@...ux.com> To: oss-security <oss-security@...ts.openwall.com> Cc: linux-distros@...openwall.org, Linus Torvalds <torvalds@...uxfoundation.org>, Greg KH <greg@...ah.com>, "security@...nel.org" <security@...nel.org>, Norbert Slusarek <nslusarek@....net>, Stefano Garzarella <sgarzare@...hat.com>, Eric Dumazet <edumazet@...gle.com>, Anthony Liguori <aliguori@...zon.com>, David Miller <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Jorgen Hansen <jhansen@...are.com>, Stefan Schmidt <stefan@...enfreihafen.org>, Jeff Vander Stoep <jeffv@...gle.com>, Andrey Konovalov <andreyknvl@...gle.com> Subject: Linux kernel: Exploitable vulnerabilities in AF_VSOCK implementation Hello! Let me inform you about the Linux kernel vulnerabilities that I've found in AF_VSOCK implementation. I managed to exploit one of them for a local privilege escalation on Fedora Server 33 for x86_64, bypassing SMEP and SMAP. I'm going to share all the details about the exploit techniques later. CONFIG_VSOCKETS and CONFIG_VIRTIO_VSOCKETS are shipped as kernel modules in all major GNU/Linux distributions. The vulnerable modules are automatically loaded when you create a socket for AF_VSOCK. That is available for unprivileged users and user namespaces are not needed for that. These vulnerabilities are race conditions caused by wrong locking in net/vmw_vsock/af_vsock.c. The race conditions were implicitly introduced in November 2019 in the commits c0cfa2d8a788fcf4 and 6a2c0962105ae8ce that added VSOCK multi-transport support. These commits were merged in the Linux kernel v5.5-rc1. I prepared the fixing patch and made responsible disclosure to security@...nel.org. Now the patch is merged into the mainline kernel: "vsock: fix the race conditions in multi-transport support" https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=c518adafa39f37858697ac9309c6cf1805581446 This patch is also backported into the affected stable trees. I've requested a CVE ID for these vulnerabilities at https://cveform.mitre.org/. Best regards, Alexander
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.