Bug 1571623 (CVE-2018-10322) - CVE-2018-10322 kernel: Invalid pointer dereference in xfs_ilock_attr_map_shared() when mounting crafted xfs image allowing denial of service
Summary: CVE-2018-10322 kernel: Invalid pointer dereference in xfs_ilock_attr_map_shar...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-10322
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact: Filesystem QE
URL:
Whiteboard: impact=low,public=20180412,reported=2...
Depends On: 1574949 1571624 1571625 1574946 1574947 1574948
Blocks: 1571629
TreeView+ depends on / blocked
 
Reported: 2018-04-25 08:47 UTC by Adam Mariš
Modified: 2019-06-11 11:13 UTC (History)
45 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can cause a NULL pointer dereference in xfs_ilock_attr_map_shared function. An attacker could trick a legitimate user or a privileged attacker could exploit this by mounting a crafted xfs filesystem image to cause a kernel panic and thus a denial of service.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:20:32 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2018:2948 None None None 2018-10-30 09:01:06 UTC
Red Hat Product Errata RHSA-2018:3083 None None None 2018-10-30 07:33:23 UTC
Red Hat Product Errata RHSA-2018:3096 None None None 2018-10-30 07:39:39 UTC

Description Adam Mariš 2018-04-25 08:47:38 UTC
The xfs_dinode_verify function in fs/xfs/libxfs/xfs_inode_buf.c in the Linux kernel can cause a NULL pointer dereference in xfs_ilock_attr_map_shared function. An attacker could trick a legitimate user or a privileged attacker could exploit this by mounting a crafted xfs filesystem image to cause a kernel panic and thus a denial of service.

References:

https://www.spinics.net/lists/linux-xfs/msg17215.html

https://bugzilla.kernel.org/show_bug.cgi?id=199377

An upstream patch:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=b42db0860e130

Comment 1 Adam Mariš 2018-04-25 08:48:40 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1571624]

Comment 7 Vladis Dronov 2018-05-04 11:59:33 UTC
Notes:

While the reproducer works when run as a privileged user (the "root"), this requires a mount of a certain filesystem image. An unprivileged attacker cannot do this even from a user+mount namespace:

$ unshare -U -r -m
# mount -t xfs xfs.img mnt/
mount: mnt/: mount failed: Operation not permitted.

The article https://lwn.net/Articles/652468/ (thanks, Jonathan!) discusses unprivileged user mounts and hostile filesystem images:
 
> ... for the most part, the mount() system call is denied to processes running
> within user namespaces, even if they are privileged in their namespaces.

It also states that unprivileged filesystem mounts are not allowed as of now in the Linux kernel and probably won't be allowed in a future. Until that such flaws are considered as not exploitable:

> There were no proposals for solutions to the hostile-filesystem problem.
> But, in the absence of some sort of assurance that they can be made safe,
> unprivileged filesystem mounts are unlikely to gain acceptance; even if the
> feature gets into the kernel, distributions would be likely to disable it.

On the other hand, there is a potential possibility that still an attacker can trick a regular user to mount a malicious filesystem image, like trick him to insert an usb-flash-drive with a forged filesystem to a desktop system which will auto-mount it. In case this results only in a system crash (a DoS due to, for example, a NULL pointer dereference) the flaw impact is low but it still exists.

Another example is that if an attacker wants to hack into his coworker's notebook. While a coworker is away (on a coffee break) an attacker may insert an usb-flash-drive into the target notebook. In case of a flaw which results in a privilege escalation the flaw's impact is high.

So the Red Hat would still consider bugs which require mounting a filesystem image to exploit as security flaws.

Comment 9 errata-xmlrpc 2018-10-30 07:33:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3083 https://access.redhat.com/errata/RHSA-2018:3083

Comment 10 errata-xmlrpc 2018-10-30 07:39:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:3096 https://access.redhat.com/errata/RHSA-2018:3096

Comment 11 errata-xmlrpc 2018-10-30 09:00:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2018:2948 https://access.redhat.com/errata/RHSA-2018:2948


Note You need to log in before you can comment on or make changes to this bug.