Date: Wed, 7 Apr 2021 19:16:07 +0800 From: 马哲宇 <zheyuma97@...il.com> To: oss-security@...ts.openwall.com Subject: CVE-2021-3483: Linux kernel: a use-after-free bug in nosy driver Hello, I found a bug in the latest Linux kernel. The location of the bug is Linux/drivers/firewire/nosy.c. Nosy is an IEEE 1394 packet sniffer which is used for protocol analysis and in the development of IEEE 1394 drivers, applications, or firmware. For each device, the nosy driver allocates a pcilynx structure. A use-after-free might happen in the following scenario: 1. Open nosy device for the first time and call ioctl with command NOSY_IOC_START, then a new client A will be malloced and added to doubly linked list. 2. Open nosy device for the second time and call ioctl with command NOSY_IOC_START, then a new client B will be malloced and added to doubly linked list. 3. Call ioctl with command NOSY_IOC_START for client A, then client A will be readded to the doubly linked list. Now the doubly linked list is messed up. 4. Close the first nosy device and nosy_release will be called. In nosy_release, client A will be unlinked and freed. 5. Close the second nosy device, and client A will be referenced, resulting in UAF. The root cause of this bug is that the element in the doubly linked list is reentered into the list. Here is the commit to patch this BUG: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=829933ef05a951c8ff140e814656d73e74915faf Regards, Zheyu Ma
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.