Red Hat Bugzilla – Bug 1641878
CVE-2018-18559 kernel: Use-after-free due to race condition in AF_PACKET implementation
Last modified: 2018-11-01 07:42:12 EDT
A use-after-free flaw can occur in the Linux kernel due to a race condition between packet_do_bind() and packet_notifier() functions called for an AF_PACKET socket. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to an unresponsive system or to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out, although we believe it is unlikely. External Reference: https://blogs.securiteam.com/index.php/archives/3731 A probable fix: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=15fe076edea787807a7cdc168df832544b58eba6
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1641879]
I guess, there is a bit of confusion here. If I understand it correctly, mainline commit 15fe076edea787807a7cdc168df832544b58eba6 "net/packet: fix a race in packet_bind() and packet_notifier()" is the actual fix for the problem. It seems, its authors just did not know that the race can lead to an exploitable use-after-free as well. The kernel 3.10.0-862.14.4 from RHEL7 does not have that mainline fix. Not sure about the newer ones. By the way, I have checked the exploit on our custom kernel based on 3.10.0-862.11.6 from RHEL 7 - if run as a non-root user, it causes kernel crashes or (in some cases) soft lockups within minutes. I added that patch from mainline, tried the exploit again - no such problems happened this time.
(In reply to Evgenii Shatokhin from comment #3) > If I understand it correctly, mainline commit > 15fe076edea787807a7cdc168df832544b58eba6 "net/packet: fix a race in > packet_bind() and packet_notifier()" is the actual fix for the problem. Evgenii, thank you for your update. Indeed, the wording in the securiteam's article regarding 15fe076edea7 is, at least, unclear. > I added that patch > from mainline, tried the exploit again - no such problems happened this time. Yes, RHEL-7 is vulnerable to this flaw without the commit 15fe076edea7 and looks like behaving correctly with this commit. so, probably this is the fix indeed. Thank you for your research and confirmation!
This was fixed for Fedora with the 4.15 kernel rebases.