Re: Linux Kernel use-after-free in SCSI generic device interface

[Salvatore Bonaccorso <carnil () debian org>]

Hi Marcus, hi List

On Fri, Dec 09, 2016 at 12:14:15AM +0100, Marcus Meissner wrote:
> Hi folks,
>
> This is CVE-2016-9576.
>
> This original post from  Dmitry Vyukov <dvyukov @ google . com> has a kasan/syzkaller report:
> https://marc.info/?l=linux-scsi&m=148010092224801&w=2
>
> https://gist.githubusercontent.com/dvyukov/80cd94b4e4c288f16ee4c787d404118b/raw/10536069562444da51b758bb39655b514ff93b45/gistfile1.txt
>
> which in turn turned out to be a kernel memory read or
> potentially even a kernel memory write, in using the scatter gather
> write mode of the /dev/sg* scsi generic devices.
>
> The affected code is in Linux down to 2.6.something (problem might require splice() to be exploitable).
>
> Linus has committed a fix for this to mainline:
>
> commit a0ac402cfcdc904f9772e1762b3fda112dcc56a0
> Author: Linus Torvalds <torvalds () linux-foundation org>
> Date:   Tue Dec 6 16:18:14 2016 -0800
>
>     Don't feed anything but regular iovec's to blk_rq_map_user_iov
>
>     In theory we could map other things, but there's a reason that function
>     is called "user_iov".  Using anything else (like splice can do) just
>     confuses it.
>
>     Reported-and-tested-by: Johannes Thumshirn <jthumshirn () suse de>
>     Cc: Al Viro <viro () ZenIV linux org uk>
>     Signed-off-by: Linus Torvalds <torvalds () linux-foundation org>

Just a heads up on CVE-2016-9576.

Ben Hutchings (Cc'ed) noticed that whilst the originally identified
commit does partly address the issue, the completed fix for the sg and
bsg driver appears to be 128394eff343fc6d2f32172f03e24829539c5835.

https://git.kernel.org/linus/128394eff343fc6d2f32172f03e24829539c5835

In Debian for the upcoming kernel updates for 3.16.x in Jessie and
3.2.x in Wheezy, thus the above was used to address CVE-2016-9576.

https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=jessie&id=160c700612e57b2939fda763430e08dd089b2496
https://anonscm.debian.org/cgit/kernel/linux.git/commit/?h=wheezy-security&id=d8cef48e69ba67583c1fc2ec8953538218054cfe

This might raise the question if we need two CVE assignments per the
two commits, or just keeping the one assigned CVE to identify the
issue?

Regards,
Salvatore