From: "Rémi Denis-Courmont" <remi@remlab•net>
To: Hyunwoo Kim <v4bel@theori•io>
Cc: courmisch@gmail•com, imv4bel@gmail•com, davem@davemloft•net,
edumazet@google•com, kuba@kernel•org, pabeni@redhat•com,
netdev@vger•kernel.org, v4bel@theori•io
Subject: Re: [PATCH] net: phonet: Fix Use-After-Free in pep_recvmsg
Date: Mon, 11 Dec 2023 18:47:47 +0200 [thread overview]
Message-ID: <4366234.TZO2pnkceX@basile.remlab.net> (raw)
In-Reply-To: <20231206042519.GA5926@ubuntu>
Le keskiviikkona 6. joulukuuta 2023, 6.25.19 EET Hyunwoo Kim a écrit :
> Hi,
>
> On Mon, Dec 04, 2023 at 09:12:11AM +0200, Rémi Denis-Courmont wrote:
> > Hi,
> >
> > Le 4 décembre 2023 08:59:52 GMT+02:00, Hyunwoo Kim <v4bel@theori•io> a
écrit :
> > >Because pep_recvmsg() fetches the skb from pn->ctrlreq_queue
> > >without holding the lock_sock and then frees it,
> > >a race can occur with pep_ioctl().
> > >A use-after-free for a skb occurs with the following flow.
> >
> > Isn't this the same issue that was reported by Huawei rootlab and for
> > which I already provided a pair of patches to the security list two
> > months ago?
> Is the issue reported to the security mailing list two months ago the same
> as this pn->ctrlreq_queue race?
No, it was another similar problem but the fixes did cover both, I think?
> > TBH, I much prefer the approach in the other patch set, which takes the
> > hit on the ioctl() side rather than the recvmsg()'s.
> That's probably a patch to add sk->sk_receive_queue.lock to pep_ioctl(), is
> that correct?
More or less
> > Unfortunately, I have no visibility on what happened or didn't happen
> > after that, since the security list is private.
> Perhaps this issue hasn't gotten much attention.
Quite possible, but now I'm between a rock and a hard place, because I don't
know what's (not) going in the security mailing list. In my understanding, it
was not really OK to bring the issue or post the patches on netdev :shrug:
--
雷米‧德尼-库尔蒙
http://www.remlab.net/
prev parent reply other threads:[~2023-12-11 20:42 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-12-04 6:59 [PATCH] net: phonet: Fix Use-After-Free in pep_recvmsg Hyunwoo Kim
2023-12-04 7:12 ` Rémi Denis-Courmont
2023-12-06 4:25 ` Hyunwoo Kim
2023-12-11 16:47 ` Rémi Denis-Courmont [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4366234.TZO2pnkceX@basile.remlab.net \
--to=remi@remlab$(echo .)net \
--cc=courmisch@gmail$(echo .)com \
--cc=davem@davemloft$(echo .)net \
--cc=edumazet@google$(echo .)com \
--cc=imv4bel@gmail$(echo .)com \
--cc=kuba@kernel$(echo .)org \
--cc=netdev@vger$(echo .)kernel.org \
--cc=pabeni@redhat$(echo .)com \
--cc=v4bel@theori$(echo .)io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox