From mboxrd@z Thu Jan  1 00:00:00 1970
From: Michael Tremer <michael.tremer@ipfire.org>
To: development@lists.ipfire.org
Subject: Re: [oss-security] [CVE-2020-12114] Linux kernel denial of service by
 corrupting mountpoint reference counter
Date: Mon, 04 May 2020 12:18:21 +0100
Message-ID: <998272E3-6CFA-4985-8808-99F0EBE1BC3A@ipfire.org>
In-Reply-To: <337d71f9-8712-6f61-c20c-36ec7c067835@ipfire.org>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============8435369215994388155=="
List-Id: <development.lists.ipfire.org>

--===============8435369215994388155==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable

Hello Peter,

Thank you for forwarding this.

I am not terribly worried about this one, because an attacker needs to have l=
ocal access to the firewall which would normally not be possible.

Of course we will patch this as soon as possible, but I do not think this jus=
tifies an emergency update.

Best,
-Michael

> On 4 May 2020, at 12:12, Peter M=C3=BCller <peter.mueller(a)ipfire.org> wro=
te:
>=20
> Hello Arne, hello * (cc'ed),
>=20
> for your information.
>=20
> Thanks, and best regards,
> Peter M=C3=BCller
>=20
>=20
> -------- Forwarded Message --------
> Subject: [oss-security] [CVE-2020-12114] Linux kernel denial of service by =
corrupting mountpoint reference counter
> Date: Mon, 4 May 2020 00:24:19 +0100
> From: Piotr Krysiuk <piotras(a)gmail.com>
> Replies to: oss-security(a)lists.openwall.com
> To: oss-security(a)lists.openwall.com
>=20
> A race condition in fs/namespace.c in the Linux kernel allows unprivileged
> local users to cause a denial of service by corrupting mountpoint reference
> counter
>=20
> # Affected Versions
>=20
> The denial of service has been reproduced against the following Linux
> kernel releases from kernel.org:
> * 4.19.118 (longterm release)
> * 4.14.177 (longterm release)
> * 4.9.220 (longterm release)
> * 4.4.220 (longterm release)
>=20
> The denial of service has also been reproduced against the following
> distribution kernel versions provided by current Ubuntu LTS releases:
> * 5.0.0-1034-gcp (distribution kernel provided by package
> "linux-image-5.0.0-1034-gcp" from Ubuntu 18.04.4 LTS)
> * 4.15.0-1061-gcp (current distribution kernel provided by package
> "linux-image-4.15.0-1061-gcp" from Ubuntu 16.04.6 LTS with all updates
> installed)
>=20
> Linux kernel releases 5.3 and newer from kernel.org are not affected.
>=20
> # Root Cause
>=20
> Unprivileged local user can cause kernel panic by triggering destruction of
> a mountpoint that is still in use.
>=20
> This is possible by exploiting a race condition to corrupt mountpoint
> reference counter when simultaneously executing put_mountpoint() and
> pivot_root():
> * one thread increments m_count member of struct mountpoint
>  [under namespace_sem, but not holding mount_lock]
>    pivot_root()
> * another thread simultaneously decrements the same m_count
>  [under mount_lock, but not holding namespace_sem]
>    put_mountpoint()
>      unhash_mnt()
>        umount_mnt()
>          mntput_no_expire()
>=20
> # Bug Fix
>=20
> To fix this race condition, grab mount_lock before updating m_count in
> pivot_root().
> This requires swapping two lines in fs/namespace.c:
> ```
> @@ -3142,8 +3142,8 @@ SYSCALL_DEFINE2(pivot_root, const char __user *,
> new_root,
>  /* make certain new is below the root */
>  if (!is_path_reachable(new_mnt, new.dentry, &root))
>  goto out4;
> - root_mp->m_count++; /* pin it so it won't go away */
>  lock_mount_hash();
> + root_mp->m_count++; /* pin it so it won't go away */
>  detach_mnt(new_mnt, &parent_path);
>  detach_mnt(root_mnt, &root_parent);
>  if (root_mnt->mnt.mnt_flags & MNT_LOCKED) {
> ```
>=20
> The above fix has been merged into all relevant longterm branches by
> upstream Linux kernel.
>=20
> The following Linux kernel releases from kernel.org incorporate the fix:
> * 4.19.119 (longterm release), see commit
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=
=3Dv4.19.119&id=3Df511dc75d22e0c000fc70b54f670c2c17f5fba9a
> * 4.14.178 (current longterm release), see commit
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=
=3Dv4.14.178&id=3De21c8c03af20932c15d8b1d3bb9cbad9607a6eab
> * 4.9.221 (current longterm release), see commit
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=
=3Dv4.9.221&id=3D91e997939dda1a866f23ddfb043dcd4a3ff57524
> * 4.4.221 (current longterm release), see commit
> https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=
=3Dv4.4.221&id=3D83354adbd7a967230bd23a547c5b695567ddba2c
>=20
> # Proof Of Concept
>=20
> I developed a PoC that allows unprivileged local users to reliably trigger
> kernel panic inside VM instances on Compute Engine of Google Cloud Platform.
>=20
> The PoC has been shared privately with <security(a)kernel.org> and via a
> private bug report with Ubuntu.
>=20
> # Discoverer
>=20
> Piotr Krysiuk <piotras(a)gmail.com>
>=20
> # References
>=20
> CVE-2020-12114 (reserved via https://cveform.mitre.org/)
>=20


--===============8435369215994388155==--