Messages in this thread | | | Date | Wed, 30 Nov 2022 13:42:23 +0100 | From | Greg Kroah-Hartman <> | Subject | Re: [PATCH 5.10 0/6] binder: backports for data leak and UAF |
| |
On Wed, Nov 30, 2022 at 03:57:59AM +0000, Carlos Llamas wrote: > This series of backports consists of 3 main patches from Todd submitted > upstream in [1]. The intention is to avoid untranslated data from the > senders to be visible to the target processes. More details of this > issue can be found in the same thread. > > Furthermore, Todd's patches also fix a use-after-free issue introduced > by commit 32e9f56a96d8 ("binder: don't detect sender/target during > buffer cleanup"). In which invalid userspace input causes unprocessed > objects to be incorrectly released. Any subsequent references to these > objects will trigger a UAF as noted by the following KASAN trace: > > [ 244.748468] ================================================================== > [ 244.750486] BUG: KASAN: use-after-free in binder_ioctl+0xb88/0x32e0 > [ 244.751276] Read of size 8 at addr ffff67b1865bea58 by task poc/593 > [ 244.752074] > [ 244.752725] CPU: 0 PID: 593 Comm: poc Not tainted 5.10.156 #1 > [ 244.753683] Hardware name: linux,dummy-virt (DT) > [ 244.754717] Call trace: > [ 244.755216] dump_backtrace+0x0/0x2a0 > [ 244.755836] show_stack+0x18/0x2c > [ 244.756306] dump_stack+0xf8/0x164 > [ 244.756807] print_address_description.constprop.0+0x9c/0x538 > [ 244.757590] kasan_report+0x120/0x200 > [ 244.758236] __asan_load8+0xa0/0xc4 > [ 244.758756] binder_ioctl+0xb88/0x32e0 > [ 244.759283] __arm64_sys_ioctl+0xd4/0x120 > [ 244.759677] el0_svc_common.constprop.0+0xac/0x270 > [ 244.760184] do_el0_svc+0x38/0xa0 > [ 244.760540] el0_svc+0x1c/0x2c > [ 244.760898] el0_sync_handler+0xe8/0x114 > [ 244.761419] el0_sync+0x180/0x1c0 > > This second issue along with the reference to the commit fixing it was > first reported by Zi Fan. > > The other 3 commits included in this series are simply upstream fixes > for the main patches. > > I've tested this series applied to 5.10 and 5.4 which fixes the issues > above as expected. So please pick these up for 5.10 and 5.4 stable. > > [1] https://lore.kernel.org/all/20211130185152.437403-1-tkjos@google.com/ > > Thanks, > Carlos Llamas > > Cc: Zi Fan Tan <zifantan@google.com> > Cc: Todd Kjos <tkjos@google.com> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
All now queued up, thanks.
greg k-h
| |