New issue
Advanced search Search tips

Issue 767385 link

Starred by 1 user

Issue metadata

Status: Fixed
Owner:
Closed: Oct 2017
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Chrome
Pri: 2
Type: Bug-Security



Sign in to add a comment

CVE-2017-14489 CrOS: Vulnerability reported in Linux kernel

Project Member Reported by vomit.go...@appspot.gserviceaccount.com, Sep 21 2017

Issue description

VOMIT (go/vomit) has received an external vulnerability report for the Linux kernel. 

Advisory: CVE-2017-14489
  Details: http://vomit.googleplex.com/advisory?id=CVE/CVE-2017-14489
  CVSS severity score: 4.9/10.0
  Description:

The iscsi_if_rx function in drivers/scsi/scsi_transport_iscsi.c in the Linux kernel through 4.13.2 allows local users to cause a denial of service (panic) by leveraging incorrect length validation.



This bug was filed by http://go/vomit
Please contact us at vomit-team@google.com if you need any assistance.

 

Comment 1 by groeck@chromium.org, Sep 21 2017

Labels: Security_Severity-Medium Security_Impact-Stable M-62 Pri-2
Owner: groeck@chromium.org
Status: ExternalDependency (was: Untriaged)
https://patchwork.kernel.org/patch/9923803/

Will discuss fix with upstream maintainer and then decide if to wait for it to be upstream or fix it locally.

Comment 2 by groeck@chromium.org, Sep 21 2017

ISCSI is not enabled in chromeos builds or in the VM container build. No stable impact for those. Still need to check Lakitu.



Comment 3 by groeck@chromium.org, Sep 21 2017

Labels: -Security_Impact-Stable -M-62 Security_Impact-None M-63
ISCSI is not enabled in any builds of chromeos, including virtual images. Marking as having no impact and moving target milestone to M-63.

Comment 4 by groeck@chromium.org, Sep 26 2017

Cc: wonderfly@google.com
Status: Assigned (was: ExternalDependency)
Upstream commit c88f0e6b06f4 ("scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly").

Status: Started (was: Assigned)
Project Member

Comment 7 by bugdroid1@chromium.org, Oct 12 2017

Labels: merge-merged-chromeos-4.4
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/de7acd1f6997c4ad360b42321e977bbced4f1cf5

commit de7acd1f6997c4ad360b42321e977bbced4f1cf5
Author: Xin Long <lucien.xin@gmail.com>
Date: Thu Oct 12 01:32:51 2017

UPSTREAM: scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly

ChunYu found a kernel crash by syzkaller:

[  651.617875] kasan: CONFIG_KASAN_INLINE enabled
[  651.618217] kasan: GPF could be caused by NULL-ptr deref or user memory access
[  651.618731] general protection fault: 0000 [#1] SMP KASAN
[  651.621543] CPU: 1 PID: 9539 Comm: scsi Not tainted 4.11.0.cov #32
[  651.621938] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[  651.622309] task: ffff880117780000 task.stack: ffff8800a3188000
[  651.622762] RIP: 0010:skb_release_data+0x26c/0x590
[...]
[  651.627260] Call Trace:
[  651.629156]  skb_release_all+0x4f/0x60
[  651.629450]  consume_skb+0x1a5/0x600
[  651.630705]  netlink_unicast+0x505/0x720
[  651.632345]  netlink_sendmsg+0xab2/0xe70
[  651.633704]  sock_sendmsg+0xcf/0x110
[  651.633942]  ___sys_sendmsg+0x833/0x980
[  651.637117]  __sys_sendmsg+0xf3/0x240
[  651.638820]  SyS_sendmsg+0x32/0x50
[  651.639048]  entry_SYSCALL_64_fastpath+0x1f/0xc2

It's caused by skb_shared_info at the end of sk_buff was overwritten by
ISCSI_KEVENT_IF_ERROR when parsing nlmsg info from skb in iscsi_if_rx.

During the loop if skb->len == nlh->nlmsg_len and both are sizeof(*nlh),
ev = nlmsg_data(nlh) will acutally get skb_shinfo(SKB) instead and set a
new value to skb_shinfo(SKB)->nr_frags by ev->type.

This patch is to fix it by checking nlh->nlmsg_len properly there to
avoid over accessing sk_buff.

BUG= chromium:767385 
TEST=Build and run

Change-Id: I3261c7cf03dcf61b4e0cc079873583dfba38b066
Reported-by: ChunYu Wang <chunwang@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit c88f0e6b06f4)
Reviewed-on: https://chromium-review.googlesource.com/706195
Reviewed-by: Bernie Thompson <bhthompson@chromium.org>

[modify] https://crrev.com/de7acd1f6997c4ad360b42321e977bbced4f1cf5/drivers/scsi/scsi_transport_iscsi.c

Project Member

Comment 8 by bugdroid1@chromium.org, Oct 12 2017

Labels: merge-merged-chromeos-4.12
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/380ec9f8473d20958a95c5ca527b7799345e9864

commit 380ec9f8473d20958a95c5ca527b7799345e9864
Author: Xin Long <lucien.xin@gmail.com>
Date: Thu Oct 12 03:45:10 2017

UPSTREAM: scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly

ChunYu found a kernel crash by syzkaller:

[  651.617875] kasan: CONFIG_KASAN_INLINE enabled
[  651.618217] kasan: GPF could be caused by NULL-ptr deref or user memory access
[  651.618731] general protection fault: 0000 [#1] SMP KASAN
[  651.621543] CPU: 1 PID: 9539 Comm: scsi Not tainted 4.11.0.cov #32
[  651.621938] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[  651.622309] task: ffff880117780000 task.stack: ffff8800a3188000
[  651.622762] RIP: 0010:skb_release_data+0x26c/0x590
[...]
[  651.627260] Call Trace:
[  651.629156]  skb_release_all+0x4f/0x60
[  651.629450]  consume_skb+0x1a5/0x600
[  651.630705]  netlink_unicast+0x505/0x720
[  651.632345]  netlink_sendmsg+0xab2/0xe70
[  651.633704]  sock_sendmsg+0xcf/0x110
[  651.633942]  ___sys_sendmsg+0x833/0x980
[  651.637117]  __sys_sendmsg+0xf3/0x240
[  651.638820]  SyS_sendmsg+0x32/0x50
[  651.639048]  entry_SYSCALL_64_fastpath+0x1f/0xc2

It's caused by skb_shared_info at the end of sk_buff was overwritten by
ISCSI_KEVENT_IF_ERROR when parsing nlmsg info from skb in iscsi_if_rx.

During the loop if skb->len == nlh->nlmsg_len and both are sizeof(*nlh),
ev = nlmsg_data(nlh) will acutally get skb_shinfo(SKB) instead and set a
new value to skb_shinfo(SKB)->nr_frags by ev->type.

This patch is to fix it by checking nlh->nlmsg_len properly there to
avoid over accessing sk_buff.

BUG= chromium:767385 
TEST=Build and run

Change-Id: I3261c7cf03dcf61b4e0cc079873583dfba38b066
Reported-by: ChunYu Wang <chunwang@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit c88f0e6b06f4)
Reviewed-on: https://chromium-review.googlesource.com/706120

[modify] https://crrev.com/380ec9f8473d20958a95c5ca527b7799345e9864/drivers/scsi/scsi_transport_iscsi.c

Project Member

Comment 9 by bugdroid1@chromium.org, Oct 12 2017

Labels: merge-merged-chromeos-3.18
The following revision refers to this bug:
  https://chromium.googlesource.com/chromiumos/third_party/kernel/+/d58cd891f65dc696f2d4f09d241f716c22e6254b

commit d58cd891f65dc696f2d4f09d241f716c22e6254b
Author: Xin Long <lucien.xin@gmail.com>
Date: Thu Oct 12 03:45:08 2017

UPSTREAM: scsi: scsi_transport_iscsi: fix the issue that iscsi_if_rx doesn't parse nlmsg properly

ChunYu found a kernel crash by syzkaller:

[  651.617875] kasan: CONFIG_KASAN_INLINE enabled
[  651.618217] kasan: GPF could be caused by NULL-ptr deref or user memory access
[  651.618731] general protection fault: 0000 [#1] SMP KASAN
[  651.621543] CPU: 1 PID: 9539 Comm: scsi Not tainted 4.11.0.cov #32
[  651.621938] Hardware name: Red Hat KVM, BIOS 0.5.1 01/01/2011
[  651.622309] task: ffff880117780000 task.stack: ffff8800a3188000
[  651.622762] RIP: 0010:skb_release_data+0x26c/0x590
[...]
[  651.627260] Call Trace:
[  651.629156]  skb_release_all+0x4f/0x60
[  651.629450]  consume_skb+0x1a5/0x600
[  651.630705]  netlink_unicast+0x505/0x720
[  651.632345]  netlink_sendmsg+0xab2/0xe70
[  651.633704]  sock_sendmsg+0xcf/0x110
[  651.633942]  ___sys_sendmsg+0x833/0x980
[  651.637117]  __sys_sendmsg+0xf3/0x240
[  651.638820]  SyS_sendmsg+0x32/0x50
[  651.639048]  entry_SYSCALL_64_fastpath+0x1f/0xc2

It's caused by skb_shared_info at the end of sk_buff was overwritten by
ISCSI_KEVENT_IF_ERROR when parsing nlmsg info from skb in iscsi_if_rx.

During the loop if skb->len == nlh->nlmsg_len and both are sizeof(*nlh),
ev = nlmsg_data(nlh) will acutally get skb_shinfo(SKB) instead and set a
new value to skb_shinfo(SKB)->nr_frags by ev->type.

This patch is to fix it by checking nlh->nlmsg_len properly there to
avoid over accessing sk_buff.

BUG= chromium:767385 
TEST=Build and run

Change-Id: I3261c7cf03dcf61b4e0cc079873583dfba38b066
Reported-by: ChunYu Wang <chunwang@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Chris Leech <cleech@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Guenter Roeck <groeck@chromium.org>
(cherry picked from commit c88f0e6b06f4)
Reviewed-on: https://chromium-review.googlesource.com/706119

[modify] https://crrev.com/d58cd891f65dc696f2d4f09d241f716c22e6254b/drivers/scsi/scsi_transport_iscsi.c

Status: Fixed (was: Started)
Project Member

Comment 11 by sheriffbot@chromium.org, Oct 12 2017

Labels: Restrict-View-SecurityNotify
Project Member

Comment 12 by sheriffbot@chromium.org, Jan 18 2018

Labels: -Restrict-View-SecurityNotify allpublic
This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

Sign in to add a comment