Bug 1641878 (CVE-2018-18559) - CVE-2018-18559 kernel: Use-after-free due to race condition in AF_PACKET implementation
Summary: CVE-2018-18559 kernel: Use-after-free due to race condition in AF_PACKET impl...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2018-18559
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1641879 1641880 1641881 1643680 1643681 1643682 1643683 1643684 1643685 1657888 1695835 1717808 1725173 1725174
Blocks: 1641883
TreeView+ depends on / blocked
 
Reported: 2018-10-23 05:44 UTC by Sam Fowler
Modified: 2021-12-10 18:01 UTC (History)
56 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
A use-after-free flaw can occur in the Linux kernel due to a race condition between packet_do_bind() and packet_notifier() functions called for an AF_PACKET socket. An unprivileged, local user could use this flaw to induce kernel memory corruption on the system, leading to an unresponsive system or to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.
Clone Of:
Environment:
Last Closed: 2019-06-10 10:40:50 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2019:0163 0 None None None 2019-01-29 17:23:49 UTC
Red Hat Product Errata RHSA-2019:0188 0 None None None 2019-01-29 17:24:22 UTC
Red Hat Product Errata RHSA-2019:1170 0 None None None 2019-05-14 19:08:34 UTC
Red Hat Product Errata RHSA-2019:1190 0 None None None 2019-05-14 20:26:57 UTC
Red Hat Product Errata RHSA-2019:3967 0 None None None 2019-11-26 11:52:25 UTC
Red Hat Product Errata RHSA-2019:4159 0 None None None 2019-12-10 11:58:36 UTC
Red Hat Product Errata RHSA-2020:0174 0 None None None 2020-01-21 15:49:36 UTC

Description Sam Fowler 2018-10-23 05:44:59 UTC 
A use-after-free flaw can occur in the Linux kernel due to a race condition between packet_do_bind() and packet_notifier() functions called for an AF_PACKET socket. An unprivileged local user could use this flaw to induce kernel memory corruption on the system, leading to an unresponsive system or to a crash. Due to the nature of the flaw, privilege escalation cannot be fully ruled out.

External Reference:

https://blogs.securiteam.com/index.php/archives/3731

A probable fix:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=15fe076edea787807a7cdc168df832544b58eba6
Comment 1 Sam Fowler 2018-10-23 05:46:07 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1641879]
Comment 3 Evgenii Shatokhin 2018-10-26 10:00:56 UTC 
I guess, there is a bit of confusion here.

If I understand it correctly, mainline commit 15fe076edea787807a7cdc168df832544b58eba6 "net/packet: fix a race in packet_bind() and packet_notifier()" is the actual fix for the problem.

It seems, its authors just did not know that the race can lead to an exploitable use-after-free as well.

The kernel 3.10.0-862.14.4 from RHEL7 does not have that mainline fix. Not sure about the newer ones.

By the way, I have checked the exploit on our custom kernel based on 3.10.0-862.11.6 from RHEL 7 - if run as a non-root user, it causes kernel crashes or (in some cases) soft lockups within minutes. I added that patch from mainline, tried the exploit again - no such problems happened this time.
Comment 5 Vladis Dronov 2018-10-26 17:42:32 UTC 
(In reply to Evgenii Shatokhin from comment #3)
> If I understand it correctly, mainline commit
> 15fe076edea787807a7cdc168df832544b58eba6 "net/packet: fix a race in
> packet_bind() and packet_notifier()" is the actual fix for the problem.

Evgenii, thank you for your update. Indeed, the wording in the securiteam's article regarding 15fe076edea7 is, at least, unclear.

> I added that patch
> from mainline, tried the exploit again - no such problems happened this time.

Yes, RHEL-7 is vulnerable to this flaw without the commit 15fe076edea7 and looks like behaving correctly with this commit. so, probably this is the fix indeed.

Thank you for your research and confirmation!
Comment 8 Justin M. Forbes 2018-11-01 11:42:12 UTC 
This was fixed for Fedora with the 4.15 kernel rebases.
Comment 9 errata-xmlrpc 2019-01-29 17:23:46 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0163 https://access.redhat.com/errata/RHSA-2019:0163
Comment 10 errata-xmlrpc 2019-01-29 17:24:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:0188 https://access.redhat.com/errata/RHSA-2019:0188
Comment 12 errata-xmlrpc 2019-05-14 19:08:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.4 Extended Update Support

Via RHSA-2019:1170 https://access.redhat.com/errata/RHSA-2019:1170
Comment 13 errata-xmlrpc 2019-05-14 20:26:55 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise MRG 2

Via RHSA-2019:1190 https://access.redhat.com/errata/RHSA-2019:1190
Comment 18 errata-xmlrpc 2019-11-26 11:52:21 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.5 Extended Update Support

Via RHSA-2019:3967 https://access.redhat.com/errata/RHSA-2019:3967
Comment 19 errata-xmlrpc 2019-12-10 11:58:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7.3 Telco Extended Update Support
  Red Hat Enterprise Linux 7.3 Advanced Update Support
  Red Hat Enterprise Linux 7.3 Update Services for SAP Solutions

Via RHSA-2019:4159 https://access.redhat.com/errata/RHSA-2019:4159
Comment 20 errata-xmlrpc 2020-01-21 15:49:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2020:0174 https://access.redhat.com/errata/RHSA-2020:0174
Note You need to log in before you can comment on or make changes to this bug.