Bug 2524262
| Summary: | getrandom: FIPS extrng module reference leaked on import_ubuf() failure, unprivileged DoS | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | aarushsingh1305 <aarushsingh1305> |
| Component: | kernel | Assignee: | Justin M. Forbes <jforbes> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | high | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 43 | CC: | acaringi, adscvr, airlied, chaithco, hans, hpa, jforbes, junjie.cao, kernel-maint, linville, masami256, mchehab, nickolasjcarr, ptalbert, steved, suraj.ghimire7, vdronov |
| Target Milestone: | --- | Keywords: | Triaged |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | kernel-7.1.13-200.fc44 kernel-7.1.13-100.fc43 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-09-04 01:11:47 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Confirmed on os-build: the try_module_get() reference is dropped only on the read path; an import_ubuf() failure returns with it held. Fix as you proposed, with your Reported-by/Suggested-by: https://gitlab.com/cki-project/kernel-ark/-/merge_requests/4727 (module_put() on the failure path; RHEL-only code, applies as-is to fedora-7.1 and fedora-7.2). Scope note: nothing in-tree calls random_register_extrng(), so on a stock Fedora kernel rng is always NULL and this path is never taken; the exposure is the out-of-tree RHEL FIPS provider. FWIW it was merged into the fedora-7.1 and fedora-7.2 branches - https://gitlab.com/cki-project/kernel-ark/-/commit/2efed24569953e88ce1f9a6ed579a71bafece833 - https://gitlab.com/cki-project/kernel-ark/-/commit/02e162bf79251e9f46e429e79eff37a4f1318f5e Afaik the kernel-ark doesn't have anything that actually would trigger this code path. As noted above, RHEL _does_ and this is being worked out in https://redhat.atlassian.net/browse/RHEL-251529. Furthermore, the work to merge into os-build is being carred out through the posted MR, https://gitlab.com/cki-project/kernel-ark/-/merge_requests/4727. Thank you for the report and the fix, most appreciated. Yes, the extrng is used in RHEL and this is a valid bug report for these. I'll work on bringing the fix into RHEL, thanks a ton. FEDORA-2026-a7b1ccd14c (kernel-7.1.13-100.fc43) has been submitted as an update to Fedora 43. https://bodhi.fedoraproject.org/updates/FEDORA-2026-a7b1ccd14c FEDORA-2026-0d885c0533 (kernel-7.1.13-200.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d885c0533 FEDORA-2026-0d885c0533 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-0d885c0533` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-0d885c0533 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-a7b1ccd14c has been pushed to the Fedora 43 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-a7b1ccd14c` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-a7b1ccd14c See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-0d885c0533 (kernel-7.1.13-200.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. FEDORA-2026-a7b1ccd14c (kernel-7.1.13-100.fc43) has been pushed to the Fedora 43 stable repository. If problem still persists, please make note of it in this bug report. |
A module reference acquired in the Fedora-specific FIPS extrng getrandom() path is leaked whenever import_ubuf() returns an error. This is reachable by any unprivileged user with no capabilities required. AFFECTED VERSIONS: Fedora 43 (kernel 7.1.10-100) and rawhide (7.3.0-rc0). This code does not exist in upstream — it is Fedora-authored and will not be resolved by a rebase. VULNERABLE CODE (drivers/char/random.c, post-patch): 1421 if (rng && !try_module_get(rng->owner)) ← reference acquired 1422 rng = NULL; ... 1426 if (rng) { 1427 ret = import_ubuf(ITER_DEST, ubuf, len, &iter); 1428 if (unlikely(ret)) 1429 return ret; ← LEAKS the reference 1430 ret = rng->extrng_read_iter(&iter, !!(flags & GRND_RANDOM)); 1431 module_put(rng->owner); ← only reached on success path 1432 return ret; 1433 } import_ubuf() returns -EFAULT on an invalid user buffer (confirmed in lib/iov_iter.c — access_ok() check). When it does, the function returns early at line 1429 without calling module_put(), leaking the reference acquired at line 1421. TRIGGER (unprivileged, any user): while (1) getrandom((void *)-1, 16, 0); /* returns -EFAULT each time */ Each call leaks one module reference. The FIPS RNG module's refcount increments without bound. Once the refcount is nonzero, modprobe -r, FIPS mode teardown, and kernel live-patch/update flows are permanently blocked for the life of the boot. This only activates when a FIPS RNG module has called random_register_extrng(). On systems without a registered extrng, rng is NULL and the branch is not taken. FIX: Add module_put(rng->owner) before the return at line 1429: 1428 if (unlikely(ret)) { 1429 module_put(rng->owner); 1430 return ret; 1431 } This is a one-line fix. No upstream patch exists because this code is Fedora-only. DISCOVERY METHOD: Static analysis of the Fedora kernel patch delta (patch-7.1-redhat.patch) against upstream linux-7.1.10. Reproducible: Always