Bug 2174400 (CVE-2023-1118)
| Summary: | CVE-2023-1118 kernel: use-after-free in drivers/media/rc/ene_ir.c due to race condition | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Alex <allarkin> |
| Component: | vulnerability | Assignee: | Nobody <nobody> |
| Status: | NEW --- | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | acaringi, bhu, chwhite, crwood, ddepaula, debarbos, dfreiber, drow, dvlasenk, ezulian, fhrbata, hkrzesin, jarod, jburrell, jfaracco, jferlan, jforbes, jlelli, joe.lawrence, jshortt, jstancek, jwyatt, kcarcia, kernel-mgr, lgoncalv, lzampier, nmurray, ptalbert, qzhao, rogbas, rvrbovsk, scweaver, tyberry, vkumar, walters, williams |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Linux kernel 6.3-rc1 | Doc Type: | If docs needed, set a value |
| Doc Text: |
A use-after-free flaw was found in the Linux kernel's integrated infrared receiver/transceiver driver. This issue occurs when a user detaches a rc device. This could allow a local user to crash the system or potentially escalate their privileges on the system.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2174401, 2174409, 2174410, 2174411, 2174412 | ||
| Bug Blocks: | 2173942 | ||
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 2174401] Expect that likely going to be fixed in Linux kernel 6.3-rc1 (check it later). This was fixed for Fedora in the 6.1.16 stable kernel updates. This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:6901 https://access.redhat.com/errata/RHSA-2023:6901 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2023:7077 https://access.redhat.com/errata/RHSA-2023:7077 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Extended Update Support Via RHSA-2024:1653 https://access.redhat.com/errata/RHSA-2024:1653 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Extended Update Support Via RHSA-2024:3810 https://access.redhat.com/errata/RHSA-2024:3810 |
A flaw in the Linux Kernel found. There are use-after-free vulnerabilities in drivers/media/rc/ene_ir.c of linux that allow attacker to crash linux kernel without any privilege by detaching rc device. When the rc device is detaching, function ene_remove() will be called. But the synchronizations in ene_remove() are bad. The situations that may lead to race conditions are shown below. Firstly, the rx receiver is disabled with ene_rx_disable() before rc_unregister_device() in ene_remove(), which means it can be enabled again if a process opens /dev/lirc0 between ene_rx_disable() and rc_unregister_device(). (cleanup routine) | (open routine) ene_remove() | ene_rx_disable(dev); | ene_open() | ene_rx_enable(dev); //re-enable! Secondly, the irqaction descriptor is freed by free_irq() before the rc device is unregistered, which means irqaction descriptor may be accessed again after it is deallocated. (free routine) | (use routine) ene_remove() | ene_rx_enable() free_irq(dev->irq, ...); //FREE | ene_rx_enable_hw() | ene_write_reg(..., dev->irq << 1) //USE | Thirdly, the timer can call ene_tx_sample() that can write to the io ports, which means the io ports could be accessed again after they are deallocated by release_region(). (free routine) | (use routine) ene_remove() | ene_tx_sample() release_region(dev->hw_io, ...); //FREE | ene_write_reg() | outb(..., dev->hw_io + ENE_IO) //USE Fourthly, there is no function to cancel tx_sim_timer in ene_remove(), the timer handler ene_tx_irqsim() could race with ene_remove(). As a result, the UAF bugs could happen, the process is shown below. (free routine) | (use routine) | mod_timer(&dev->tx_sim_timer, ..) ene_remove() | (wait a time) kfree(dev) //FREE | ene_tx_irqsim() | dev->hw_lock //USE | ene_tx_sample(dev) //USE ------------------------------------------ Reference: https://github.com/torvalds/linux/commit/29b0589a865b6f66d141d79b2dd1373e4e50fe17