oss-security - [CVE-2021-3492] Ubuntu shiftfs Linux kernel file system double free vulnerability

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Date: Thu, 15 Apr 2021 14:33:06 -0700
From: Steve Beattie <steve.beattie@...onical.com>
To: oss-security@...ts.openwall.com
Subject: [CVE-2021-3492] Ubuntu shiftfs Linux kernel file system double free
 vulnerability

Hello,

Shiftfs is an out-of-tree stacking file system for the Linux kernel
included in Ubuntu kernels that can be mounted by unprivileged users
within unprivileged user namespaces.

Vincent Dehors discovered that shiftfs, when passing through
ioctls to the underlying file system, did not properly handle faults
occurring during copy_from_user() correctly, leading to a double-free
vulnerability or not freeing memory at all. An attacker could use
this to cause a denial of service (memory consumption) or execute
arbitrary code.

The commits to address this issue are as follows:

 Ubuntu 20.10:
  5c4ddd2d104e ("UBUNTU: SAUCE: shiftfs: free allocated memory in shiftfs_btrfs_ioctl_fd_replace() error paths")
  https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/groovy/commit/?id=5c4ddd2d104e5561724c636c9a83ab722255dc2e
  a92f3ddbb391 ("UBUNTU: SAUCE: shiftfs: handle copy_to_user() return values correctly")
  https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/groovy/commit/?id=a92f3ddbb391ce466a470e578cb24a37d7eb813c

 Ubuntu 20.04 LTS:
  8fee52ab9da8 ("UBUNTU: SAUCE: shiftfs: free allocated memory in shiftfs_btrfs_ioctl_fd_replace() error paths")
  https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=8fee52ab9da87d82bc6de9ebb3480fff9b4d53e6
  25c891a949bf ("UBUNTU: SAUCE: shiftfs: handle copy_to_user() return values correctly")
  https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=25c891a949bf918b59cbc6e4932015ba4c35c333

As shiftfs has not been accepted in the upstream Linux kernel, the
upstream Linux kernel is not affected by CVE-2021-3492.

This issue is also identified as ZDI-CAN-13562.
-- 
Steve Beattie
<sbeattie@...ntu.com>

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.