[prev in list] [next in list] [prev in thread] [next in thread] 

List:       oss-security
Subject:    [oss-security] CVE-2022-0617: udf:A null-ptr-deref bug be triggered when write to an ICB inode
From:       butt3rflyh4ck <butterflyhuangxx () gmail ! com>
Date:       2022-04-13 15:42:18
Message-ID: CAFcO6XPukbwY3wK6AqP6qJ-3-3KPN760pAJCDu0tV-EXSGRecA () mail ! gmail ! com
[Download RAW message or body]

A NULL pointer dereference was found in the Linux kernel's UDF file
system functionality in the way the user triggers the
udf_file_write_iter function for a malicious UDF image. Actual from
Linux kernel 4.2-rc1 till 5.17-rc2.

#Root Cause
udf_expand_file_adinicb() calls directly ->writepage to write data
expanded into a page. This however misses to setup inode for writeback
properly and so we can crash on inode->i_wb dereference when submitting
page for IO like:

  BUG: kernel NULL pointer dereference, address: 0000000000000158
  #PF: supervisor read access in kernel mode
...
  <TASK>
  __folio_start_writeback+0x2ac/0x350
  __block_write_full_page+0x37d/0x490
  udf_expand_file_adinicb+0x255/0x400 [udf]
  udf_file_write_iter+0xbe/0x1b0 [udf]
  new_sync_write+0x125/0x1c0
  vfs_write+0x28e/0x400

Fix the problem by marking the page dirty and going through the standard
writeback path to write the page. Strictly speaking we would not even
have to write the page but we want to catch e.g. ENOSPC errors early.

#Fix
1.https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7fc3b7c2981bbd1047916ade327beccb90994eee
 2.https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ea8569194b43f0f01f0a84c689388542c7254a1f


#CVE
Red Hat has assigned CVE-2022-0617 to this issue.
1. https://access.redhat.com/security/cve/CVE-2022-0617
2. https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0617

#Credit
this issue is reported by Active Defense Lab of Venustech.


Regards,
 butt3rflyh4ck.

-- 
Active Defense Lab of Venustech


[prev in list] [next in list] [prev in thread] [next in thread]