CVE-2021-3483: security - CVE-2021-3483: Linux kernel: a use-after-free bug in nosy driver

• Products
  • Openwall GNU/*/Linux server OS
  • Linux Kernel Runtime Guard
  • John the Ripper password cracker
    • Free & Open Source for any platform
    • in the cloud
    • Pro for Linux
    • Pro for macOS
  • Wordlists for password cracking
  • passwdqc policy enforcement
    • Free & Open Source for Unix
    • Pro for Windows (Active Directory)
  • yescrypt KDF & password hashing
  • yespower Proof-of-Work (PoW)
  • crypt_blowfish password hashing
  • phpass ditto in PHP
  • tcb better password shadowing
  • Pluggable Authentication Modules
  • scanlogd port scan detector
  • popa3d tiny POP3 daemon
  • blists web interface to mailing lists
  • msulogin single user mode login
  • php_mt_seed mt_rand() cracker
• Services
• Publications
  • Articles
  • Presentations
• Resources
  • Mailing lists
  • Community wiki
  • Source code repositories (GitHub)
  • Source code repositories (CVSweb)
  • File archive & mirrors
  • How to verify digital signatures
  • OVE IDs
• What’s new

[<prev] [next>] [day] [month] [year] [list]

Date: Wed, 7 Apr 2021 19:16:07 +0800 From: 马哲宇 <zheyuma97@…il.com> To: oss-security@…ts.openwall.com Subject: CVE-2021-3483: Linux kernel: a use-after-free bug in nosy driver

Hello,

I found a bug in the latest Linux kernel. The location of the bug is Linux/drivers/firewire/nosy.c. Nosy is an IEEE 1394 packet sniffer which is used for protocol analysis and in the development of IEEE 1394 drivers, applications, or firmware.

For each device, the nosy driver allocates a pcilynx structure. A use-after-free might happen in the following scenario:

1. Open nosy device for the first time and call ioctl with command NOSY_IOC_START, then a new client A will be malloced and added to doubly linked list.
2. Open nosy device for the second time and call ioctl with command NOSY_IOC_START, then a new client B will be malloced and added to doubly linked list.
3. Call ioctl with command NOSY_IOC_START for client A, then client A will be readded to the doubly linked list. Now the doubly linked list is messed up.
4. Close the first nosy device and nosy_release will be called. In nosy_release, client A will be unlinked and freed.
5. Close the second nosy device, and client A will be referenced, resulting in UAF.

The root cause of this bug is that the element in the doubly linked list is reentered into the list.

Here is the commit to patch this BUG: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=829933ef05a951c8ff140e814656d73e74915faf

Regards,

Zheyu Ma

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.