Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
MIME-Version: 1.0
References: <1540051091-16604-1-git-send-email-wang6495@umn.edu> <F93F08E0-9D18-4C1A-8214-8AEAC829B317@gmail.com>
In-Reply-To: <F93F08E0-9D18-4C1A-8214-8AEAC829B317@gmail.com>
From:   Wenwen Wang <wang6495@umn.edu>
Date:   Mon, 29 Oct 2018 13:53:39 -0500
Message-ID: <CAAa=b7cbS0ycDF3sgXn6C9QpczLk5Sy5o-JCi66tTTGtkGoWbQ@mail.gmail.com>
Subject: Re: [PATCH] net: socket: fix a missing-check bug
To:     f.fainelli@gmail.com
Cc:     Kangjie Lu <kjlu@umn.edu>, "David S. Miller" <davem@davemloft.net>,
        "open list:NETWORKING [GENERAL]" <netdev@vger.kernel.org>,
        open list <linux-kernel@vger.kernel.org>,
        Wenwen Wang <wang6495@umn.edu>
Content-Type: text/plain; charset="UTF-8"
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

Hi Florian,

Thanks for your response. The bug is found with the assistance of a
research prototype, which is now not available to the public.

Yes, this is a kind of time-of-check-to-time-of-use (TOCTTOU) bug.

BTW, could you please confirm this bug? Thanks!

Wenwen

On Sat, Oct 20, 2018 at 10:21 PM Florian Fainelli <f.fainelli@gmail.com> wrote:
>
> Hi Wenwen,
>
> On October 20, 2018 8:58:10 AM PDT, Wenwen Wang <wang6495@umn.edu> wrote:
> >In ethtool_ioctl(), the ioctl command is firstly obtained from the
> >user-space buffer 'compat_rxnfc' through get_user() and saved to
> >'ethcmd'.
> >Then, 'ethcmd' is checked to see whether it is necessary to pre-process
> >the
> >ethool structure, because the structure ethtool_rxnfc is defined with
> >padding, as mentioned in the comment. If yes, a user-space buffer
> >'rxnfc'
> >is allocated through compat_alloc_user_space() and then the data in the
> >original buffer 'compat_rxnfc' is copied to 'rxnfc' through
> >copy_in_user(),
> >including the ioctl command. It is worth noting that after this copy,
> >there
> >is no check enforced on the copied ioctl command. That means it is
> >possible
> >that 'rxnfc->cmd' is different from 'ethcmd', because a malicious user
> >can
> >race to modify the ioctl command in 'compat_rxnfc' between these two
> >copies. Eventually, the ioctl command in 'rxnfc' will be used in
> >dev_ethtool(). This can cause undefined behavior of the kernel and
> >introduce potential security risk.
> >
> >This patch avoids the above issue by rewriting 'rxnfc->cmd' using
> >'ethcmd'
> >after copy_in_user().
> >
> >Signed-off-by: Wenwen Wang <wang6495@umn.edu>
>
> Assuming these issues are found with some kind of automated analysis, can you also add in your work flow to provide a Fixes: tag such that this could be backported to stable kernels?
>
> If this is found by a tool is this something that is open source and somehow available? I would also make it clear that these issues are typically named time TOCTOU which might be clearer for people who review those patches.
>
> Thanks!
> --
> Florian