In the Linux kernel, the following vulnerability has been resolved:
ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry
do_mq_timedreceive calls wq_sleep with a stack local address. The sender (do_mq_timedsend) uses this address to later call pipelined_send.
This leads to a very hard to trigger race where a do_mq_timedreceive call might return and leave do_mq_timedsend to rely on an invalid address, causing the following crash:
RIP: 0010:wake_q_add_safe+0x13/0x60 Call Trace: __x64_sys_mq_timedsend+0x2a9/0x490 do_syscall_64+0x80/0x680 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f5928e40343
The race occurs as:
1. do_mq_timedreceive calls wq_sleep with the address of `struct ext_wait_queue` on function stack (aliased as `ewq_addr` here) - it holds a valid `struct ext_wait_queue *` as long as the stack has not been overwritten.
2. `ewq_addr` gets added to info->e_wait_q[RECV].list in wq_add, and do_mq_timedsend receives it via wq_get_first_waiter(info, RECV) to call __pipelined_op.
3. Sender calls __pipelined_op::smp_store_release(&this->state, STATE_READY). Here is where the race window begins. (`this` is `ewq_addr`.)
4. If the receiver wakes up now in do_mq_timedreceive::wq_sleep, it will see `state == STATE_READY` and break.
5. do_mq_timedreceive returns, and `ewq_addr` is no longer guaranteed to be a `struct ext_wait_queue *` since it was on do_mq_timedreceive's stack. (Although the address may not get overwritten until another function happens to touch it, which means it can persist around for an indefinite time.)
6. do_mq_timedsend::__pipelined_op() still believes `ewq_addr` is a `struct ext_wait_queue *`, and uses it to find a task_struct to pass to the wake_q_add_safe call. In the lucky case where nothing has overwritten `ewq_addr` yet, `ewq_addr->task` is the right task_struct. In the unlucky case, __pipelined_op::wake_q_add_safe gets handed a bogus address as the receiver's task_struct causing the crash.
do_mq_timedsend::__pipelined_op() should not dereference `this` after setting STATE_READY, as the receiver counterpart is now free to return. Change __pipelined_op to call wake_q_add_safe on the receiver's task_struct returned by get_task_struct, instead of dereferencing `this` which sits on the receiver's stack.
As Manfred pointed out, the race potentially also exists in ipc/msg.c::expunge_all and ipc/sem.c::wake_up_sem_queue_prepare. Fix those in the same way.
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade kernel-debug-modulesUpgrade kernel-rt-debug-kvmUpgrade kernel-debug-develUpgrade kernel-rt-debugUpgrade kernel-rt-develUpgrade kernel-zfcpdump-modulesUpgrade kernel-modules-extraUpgrade kernelUpgrade bpftoolUpgrade kernel-rt-debug-modulesUpgrade kernel-zfcpdumpUpgrade kernel-toolsUpgrade kernel-zfcpdump-modules-extraUpgrade kernel-zfcpdump-develUpgrade kernel-rt-kvmUpgrade kernel-modulesUpgrade kernel-debug-modules-extraUpgrade kernel-abi-stablelistsUpgrade kernel-debug-coreUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-coreUpgrade kernel-rtUpgrade kernel-debugUpgrade kernel-rt-debug-coreUpgrade kernel-tools-libs-develUpgrade kernel-headersUpgrade kernel-rt-debug-modules-extraUpgrade python3-perfUpgrade kernel-zfcpdump-coreUpgrade perfUpgrade kernel-rt-modules-extraUpgrade kernel-develUpgrade kernel-cross-headersUpgrade kernel-rt-coreUpgrade kernel-docUpgrade kernel-rt-debug-devel | Jul 3, 2024 | Mar 1, 2024 |
| Amazon Linux Ami 2 | — | Upgrade perfUpgrade bpftoolUpgrade kernel-toolsUpgrade kernel-tools-develUpgrade kernel-debuginfo-common-aarch64Upgrade perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-develUpgrade kernel-debuginfo-common-x86_64Upgrade python-perf-debuginfoUpgrade kernel-debuginfoUpgrade kernelUpgrade python-perfUpgrade kernel-headersUpgrade bpftool-debuginfo | Aug 2, 2024 | Mar 1, 2024 |
| Debian | — | Upgrade linux | Jul 30, 2024 | Mar 1, 2024 |
| Oracle_linux | — | Upgrade kernel | Jul 3, 2024 | Mar 1, 2024 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Jul 3, 2024 | Mar 1, 2024 |
| Rocky_linux | — | Upgrade kernel-toolsUpgrade kernelUpgrade perfUpgrade kernel-rt-debuginfoUpgrade kernel-rtUpgrade kernel-debug-modules-extraUpgrade kernel-tools-libs-develUpgrade kernel-rt-modules-extraUpgrade python3-perfUpgrade kernel-rt-kvmUpgrade kernel-cross-headersUpgrade kernel-rt-coreUpgrade kernel-rt-debug-develUpgrade kernel-debug-debuginfoUpgrade kernel-modulesUpgrade kernel-headersUpgrade kernel-develUpgrade kernel-debuginfoUpgrade kernel-debug-modulesUpgrade kernel-rt-debug-coreUpgrade kernel-rt-debuginfo-common-x86_64Upgrade kernel-modules-extraUpgrade kernel-coreUpgrade kernel-tools-libsUpgrade kernel-rt-modulesUpgrade kernel-debuginfo-common-x86_64Upgrade kernel-rt-debug-debuginfoUpgrade kernel-rt-debugUpgrade kernel-rt-debug-kvmUpgrade python3-perf-debuginfoUpgrade kernel-tools-debuginfoUpgrade perf-debuginfoUpgrade kernel-rt-develUpgrade kernel-rt-debug-modulesUpgrade bpftool-debuginfoUpgrade kernel-debugUpgrade kernel-rt-debug-modules-extraUpgrade kernel-debug-coreUpgrade bpftoolUpgrade kernel-debug-devel | Jul 16, 2024 | Mar 1, 2024 |
| Suse | — | Upgrade reiserfs-kmp-defaultUpgrade kernel-sourceUpgrade kernel-zfcpdumpUpgrade kernel-develUpgrade kernel-default-develUpgrade kernel-preemptUpgrade kernel-64kb-develUpgrade kernel-preempt-develUpgrade kernel-64kbUpgrade kernel-obs-buildUpgrade kernel-defaultUpgrade kernel-macrosUpgrade kernel-default-baseUpgrade kernel-docsUpgrade kernel-syms | Aug 9, 2024 | Mar 1, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub