In the Linux kernel, the following vulnerability has been resolved:
brd: defer automatic disk creation until module initialization succeeds
My colleague Wupeng found the following problems during fault injection:
BUG: unable to handle page fault for address: fffffbfff809d073 PGD 6e648067 P4D 123ec8067 PUD 123ec4067 PMD 100e38067 PTE 0 Oops: Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 5 UID: 0 PID: 755 Comm: modprobe Not tainted 6.12.0-rc3+ #17 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.1-2.fc37 04/01/2014 RIP: 0010:_asanload8+0x4c/0xa0 ... Call Trace: <TASK> blkdevputwhole+0x41/0x70 bdevrelease+0x1a3/0x250 blkdevrelease+0x11/0x20 _fput+0x1d7/0x4a0 taskworkrun+0xfc/0x180 syscallexittousermode+0x1de/0x1f0 dosyscall64+0x6b/0x170 entrySYSCALL64after_hwframe+0x76/0x7e
loopinit() is calling loopadd() after _registerblkdev() succeeds and is ignoring diskadd() failure from loopadd(), for loopadd() failure is not fatal and successfully created disks are already visible to bdevopen().
brdinit() is currently calling brdalloc() before _registerblkdev() succeeds and is releasing successfully created disks when brd_init() returns an error. This can cause UAF for the latter two case:
case 1: T1: modprobe brd brdinit brdalloc(0) // success adddisk diskscanpartitions bdevfileopenbydev // alloc file fput // won't free until back to userspace brdalloc(1) // failed since mem alloc error inject // error path for modprobe will release code segment // back to userspace _fput blkdevrelease bdevrelease blkdevputwhole bdev->bddisk->fops->release // fops is freed now, UAF!
case 2: T1: T2: modprobe brd brdinit brdalloc(0) // success open(/dev/ram0) brd_alloc(1) // fail // error path for modprobe
close(/dev/ram0)
...
/* UAF! */
bdev->bd_disk->fops->release
Fix this problem by following what loopinit() does. Besides, reintroduce brddevicesmutex to help serialize modifications to brdlist.
[
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41219c147df8bbd6591f59af5d695fb6c9a1cbff",
"target": {
"function": "brd_init",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-02ca3da0",
"digest": {
"function_hash": "65140280053406527188974264111098167856",
"length": 445.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c2744cd2939ec5999c51dbaf2af16886548b7b",
"target": {
"function": "brd_alloc",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-09204008",
"digest": {
"function_hash": "238124805543385184683515901400989636266",
"length": 1354.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@410896624db639500f24f46478b4bfa05c76bf56",
"target": {
"function": "brd_alloc",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-18c2082a",
"digest": {
"function_hash": "48935281472839478486018644330317846278",
"length": 1284.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@259bf925583ec9e3781df778cadf00594095090d",
"target": {
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-56693-3cee1d5a",
"digest": {
"line_hashes": [
"167224533772432193008316555342371580178",
"339213803085541172880106363022359670147",
"73638543936352703445541655918874719808",
"86269134029727627044141614043848787539",
"314214658450402851364575045042444757158",
"195957888660640820982583982417620583640",
"201004780499497687503038011528112314005",
"184735545834128588787000932663297101580",
"42361002176123089840230871615371338794",
"322412742999700146341329593384104462678",
"236203738220855827237921676524864357252",
"146145900945631291609906173426009574007",
"203054768154913937221302070546025096229",
"278949759076762810842953497447872218105",
"149017020530981294840697200701697182730",
"182665697741799319216033439472774283848",
"51219156519668754218103709679593345532",
"187687607664120381348397860247147786498",
"163346840329393864484824081130661544723",
"332941848559468841127502489652549157710",
"63991325242501749753502151284894772131",
"245982459171805043840661858352615641612",
"123597226273309555525131709872457912035",
"174262405678901597965572057314051145074",
"63195531825585511680259221346326203534",
"225537174062866932708287016206592370210",
"77432895895069495674507478289446219257",
"220661227085869502072308561973867904540",
"14155418208764675878058523625915495048",
"104310210228786370072723765574840903299",
"275814167991443231315170667712118859644",
"203673631734786624153529062367594416072",
"210319942999459689072576913891580572980",
"42971500172745161905769553781579969052",
"69926012569298369209690196407489035805",
"205802693436619835544000030877634818336",
"60794532626564041531087166356997271471",
"64113835251644701234544680570523160644",
"143770093516563300388833877129314686878",
"146397145218599905808038578468711902788"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41219c147df8bbd6591f59af5d695fb6c9a1cbff",
"target": {
"function": "brd_alloc",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-3f1a59bb",
"digest": {
"function_hash": "21601300339180363068592846896010947166",
"length": 1364.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c2744cd2939ec5999c51dbaf2af16886548b7b",
"target": {
"function": "brd_init",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-41ad756d",
"digest": {
"function_hash": "65140280053406527188974264111098167856",
"length": 445.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@259bf925583ec9e3781df778cadf00594095090d",
"target": {
"function": "brd_init",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-48828b06",
"digest": {
"function_hash": "65140280053406527188974264111098167856",
"length": 445.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@410896624db639500f24f46478b4bfa05c76bf56",
"target": {
"function": "brd_init",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-4f7a734d",
"digest": {
"function_hash": "65140280053406527188974264111098167856",
"length": 445.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63dfd728b30f79495dacc886127695a379805152",
"target": {
"function": "brd_alloc",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-5fe02a92",
"digest": {
"function_hash": "238124805543385184683515901400989636266",
"length": 1354.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@259bf925583ec9e3781df778cadf00594095090d",
"target": {
"function": "brd_alloc",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-6b085040",
"digest": {
"function_hash": "231204760986517580368517483529580236770",
"length": 1329.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@259bf925583ec9e3781df778cadf00594095090d",
"target": {
"function": "brd_cleanup",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-6eced59a",
"digest": {
"function_hash": "153480907109585049239168789125081008507",
"length": 291.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41219c147df8bbd6591f59af5d695fb6c9a1cbff",
"target": {
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-56693-767975d0",
"digest": {
"line_hashes": [
"167224533772432193008316555342371580178",
"339213803085541172880106363022359670147",
"73638543936352703445541655918874719808",
"86269134029727627044141614043848787539",
"314214658450402851364575045042444757158",
"195957888660640820982583982417620583640",
"201004780499497687503038011528112314005",
"184735545834128588787000932663297101580",
"42361002176123089840230871615371338794",
"322412742999700146341329593384104462678",
"236203738220855827237921676524864357252",
"146145900945631291609906173426009574007",
"203054768154913937221302070546025096229",
"278949759076762810842953497447872218105",
"149017020530981294840697200701697182730",
"182665697741799319216033439472774283848",
"329305593120029419131543759885545634192",
"310611609190175482302961601232493843341",
"163346840329393864484824081130661544723",
"332941848559468841127502489652549157710",
"63991325242501749753502151284894772131",
"2532963621936672212860075786793617574",
"182663269553803949231379575636092237324",
"174262405678901597965572057314051145074",
"63195531825585511680259221346326203534",
"225537174062866932708287016206592370210",
"77432895895069495674507478289446219257",
"220661227085869502072308561973867904540",
"14155418208764675878058523625915495048",
"104310210228786370072723765574840903299",
"275814167991443231315170667712118859644",
"203673631734786624153529062367594416072",
"210319942999459689072576913891580572980",
"42971500172745161905769553781579969052",
"69926012569298369209690196407489035805",
"205802693436619835544000030877634818336",
"60794532626564041531087166356997271471",
"64113835251644701234544680570523160644",
"143770093516563300388833877129314686878",
"146397145218599905808038578468711902788"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c2744cd2939ec5999c51dbaf2af16886548b7b",
"target": {
"function": "brd_cleanup",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-7ec7c7c7",
"digest": {
"function_hash": "153480907109585049239168789125081008507",
"length": 291.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@410896624db639500f24f46478b4bfa05c76bf56",
"target": {
"function": "brd_cleanup",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-85f39231",
"digest": {
"function_hash": "153480907109585049239168789125081008507",
"length": 291.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63dfd728b30f79495dacc886127695a379805152",
"target": {
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-56693-9a18cb8f",
"digest": {
"line_hashes": [
"167224533772432193008316555342371580178",
"339213803085541172880106363022359670147",
"73638543936352703445541655918874719808",
"86269134029727627044141614043848787539",
"314214658450402851364575045042444757158",
"270092075887499403731768901727455087391",
"207402774889717203165776076478133946253",
"302647119578513523092651447829443730705",
"42361002176123089840230871615371338794",
"322412742999700146341329593384104462678",
"236203738220855827237921676524864357252",
"146145900945631291609906173426009574007",
"203054768154913937221302070546025096229",
"3086429918230642589898985063622248084",
"70949265446472049752484878354669277113",
"257865092388941991244234566772367028408",
"51219156519668754218103709679593345532",
"187687607664120381348397860247147786498",
"163346840329393864484824081130661544723",
"332941848559468841127502489652549157710",
"63991325242501749753502151284894772131",
"245982459171805043840661858352615641612",
"123597226273309555525131709872457912035",
"174262405678901597965572057314051145074",
"63195531825585511680259221346326203534",
"225537174062866932708287016206592370210",
"77432895895069495674507478289446219257",
"220661227085869502072308561973867904540",
"14155418208764675878058523625915495048",
"104310210228786370072723765574840903299",
"275814167991443231315170667712118859644",
"203673631734786624153529062367594416072",
"210319942999459689072576913891580572980",
"42971500172745161905769553781579969052",
"69926012569298369209690196407489035805",
"205802693436619835544000030877634818336",
"60794532626564041531087166356997271471",
"64113835251644701234544680570523160644",
"143770093516563300388833877129314686878",
"146397145218599905808038578468711902788"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@410896624db639500f24f46478b4bfa05c76bf56",
"target": {
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-56693-acc63466",
"digest": {
"line_hashes": [
"167224533772432193008316555342371580178",
"339213803085541172880106363022359670147",
"73638543936352703445541655918874719808",
"86269134029727627044141614043848787539",
"314214658450402851364575045042444757158",
"195957888660640820982583982417620583640",
"201004780499497687503038011528112314005",
"184735545834128588787000932663297101580",
"42361002176123089840230871615371338794",
"322412742999700146341329593384104462678",
"236203738220855827237921676524864357252",
"146145900945631291609906173426009574007",
"203054768154913937221302070546025096229",
"3086429918230642589898985063622248084",
"70949265446472049752484878354669277113",
"257865092388941991244234566772367028408",
"51219156519668754218103709679593345532",
"187687607664120381348397860247147786498",
"163346840329393864484824081130661544723",
"332941848559468841127502489652549157710",
"63991325242501749753502151284894772131",
"245982459171805043840661858352615641612",
"123597226273309555525131709872457912035",
"174262405678901597965572057314051145074",
"63195531825585511680259221346326203534",
"225537174062866932708287016206592370210",
"77432895895069495674507478289446219257",
"220661227085869502072308561973867904540",
"14155418208764675878058523625915495048",
"104310210228786370072723765574840903299",
"275814167991443231315170667712118859644",
"203673631734786624153529062367594416072",
"210319942999459689072576913891580572980",
"42971500172745161905769553781579969052",
"69926012569298369209690196407489035805",
"205802693436619835544000030877634818336",
"60794532626564041531087166356997271471",
"64113835251644701234544680570523160644",
"143770093516563300388833877129314686878",
"146397145218599905808038578468711902788"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@826cc42adf44930a633d11a5993676d85ddb0842",
"target": {
"function": "brd_alloc",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-bbb60c2b",
"digest": {
"function_hash": "238124805543385184683515901400989636266",
"length": 1354.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@41219c147df8bbd6591f59af5d695fb6c9a1cbff",
"target": {
"function": "brd_cleanup",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-bcab3406",
"digest": {
"function_hash": "153480907109585049239168789125081008507",
"length": 291.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@826cc42adf44930a633d11a5993676d85ddb0842",
"target": {
"function": "brd_cleanup",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-bf4c2b39",
"digest": {
"function_hash": "153480907109585049239168789125081008507",
"length": 291.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@826cc42adf44930a633d11a5993676d85ddb0842",
"target": {
"function": "brd_init",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-c6f8a418",
"digest": {
"function_hash": "65140280053406527188974264111098167856",
"length": 445.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63dfd728b30f79495dacc886127695a379805152",
"target": {
"function": "brd_init",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-dc6c0788",
"digest": {
"function_hash": "65140280053406527188974264111098167856",
"length": 445.0
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@c0c2744cd2939ec5999c51dbaf2af16886548b7b",
"target": {
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-56693-e57ce9b5",
"digest": {
"line_hashes": [
"167224533772432193008316555342371580178",
"339213803085541172880106363022359670147",
"73638543936352703445541655918874719808",
"86269134029727627044141614043848787539",
"314214658450402851364575045042444757158",
"270092075887499403731768901727455087391",
"207402774889717203165776076478133946253",
"302647119578513523092651447829443730705",
"42361002176123089840230871615371338794",
"322412742999700146341329593384104462678",
"236203738220855827237921676524864357252",
"146145900945631291609906173426009574007",
"203054768154913937221302070546025096229",
"3086429918230642589898985063622248084",
"70949265446472049752484878354669277113",
"257865092388941991244234566772367028408",
"51219156519668754218103709679593345532",
"187687607664120381348397860247147786498",
"163346840329393864484824081130661544723",
"332941848559468841127502489652549157710",
"63991325242501749753502151284894772131",
"245982459171805043840661858352615641612",
"123597226273309555525131709872457912035",
"174262405678901597965572057314051145074",
"63195531825585511680259221346326203534",
"225537174062866932708287016206592370210",
"77432895895069495674507478289446219257",
"220661227085869502072308561973867904540",
"14155418208764675878058523625915495048",
"104310210228786370072723765574840903299",
"275814167991443231315170667712118859644",
"203673631734786624153529062367594416072",
"210319942999459689072576913891580572980",
"42971500172745161905769553781579969052",
"69926012569298369209690196407489035805",
"205802693436619835544000030877634818336",
"60794532626564041531087166356997271471",
"64113835251644701234544680570523160644",
"143770093516563300388833877129314686878",
"146397145218599905808038578468711902788"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@826cc42adf44930a633d11a5993676d85ddb0842",
"target": {
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"id": "CVE-2024-56693-ee84f206",
"digest": {
"line_hashes": [
"167224533772432193008316555342371580178",
"339213803085541172880106363022359670147",
"73638543936352703445541655918874719808",
"86269134029727627044141614043848787539",
"314214658450402851364575045042444757158",
"270092075887499403731768901727455087391",
"207402774889717203165776076478133946253",
"302647119578513523092651447829443730705",
"42361002176123089840230871615371338794",
"322412742999700146341329593384104462678",
"236203738220855827237921676524864357252",
"146145900945631291609906173426009574007",
"203054768154913937221302070546025096229",
"3086429918230642589898985063622248084",
"70949265446472049752484878354669277113",
"257865092388941991244234566772367028408",
"51219156519668754218103709679593345532",
"187687607664120381348397860247147786498",
"163346840329393864484824081130661544723",
"332941848559468841127502489652549157710",
"63991325242501749753502151284894772131",
"245982459171805043840661858352615641612",
"123597226273309555525131709872457912035",
"174262405678901597965572057314051145074",
"63195531825585511680259221346326203534",
"225537174062866932708287016206592370210",
"77432895895069495674507478289446219257",
"220661227085869502072308561973867904540",
"14155418208764675878058523625915495048",
"104310210228786370072723765574840903299",
"275814167991443231315170667712118859644",
"203673631734786624153529062367594416072",
"210319942999459689072576913891580572980",
"42971500172745161905769553781579969052",
"69926012569298369209690196407489035805",
"205802693436619835544000030877634818336",
"60794532626564041531087166356997271471",
"64113835251644701234544680570523160644",
"143770093516563300388833877129314686878",
"146397145218599905808038578468711902788"
],
"threshold": 0.9
}
},
{
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@63dfd728b30f79495dacc886127695a379805152",
"target": {
"function": "brd_cleanup",
"file": "drivers/block/brd.c"
},
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"id": "CVE-2024-56693-fc2cf461",
"digest": {
"function_hash": "153480907109585049239168789125081008507",
"length": 291.0
}
}
]