Page MenuHomeFreeBSD
Differential D59104

posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
ClosedPublic
Actions

Authored by markj on Fri, Aug 21, 9:42 PM.
Tags
None
Referenced Files
F170756543: D59104.id.diff
Sun, Sep 6, 10:52 AM
F170751849: D59104.id184699.diff
Sun, Sep 6, 10:14 AM
F170745775: D59104.id184699.diff
Sun, Sep 6, 9:24 AM
F170720693: D59104.id185041.diff
Sun, Sep 6, 5:19 AM
Unknown Object (File)
Sat, Sep 5, 3:13 PM
Unknown Object (File)
Sat, Sep 5, 10:13 AM
Unknown Object (File)
Sat, Sep 5, 3:45 AM
Unknown Object (File)
Fri, Sep 4, 11:09 PM
View All 33 Files
Subscribers
kib
secteam

Details

Reviewers
kib
Group Reviewers
secteam
Commits
rG840fd9dc7de2: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
rGa372e73712cf: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
rG9c7f4633c57a: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
rGcec488c1669b: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
rG6bfd894c8b14: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
rG5990860ca841: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
rGb13a7008282a: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler
Summary

The check for whether shm_lp_psind was assigned was unlocked. This race
can be exploited to create an object with psind==2 but with only
pagesizes[1] worth of pages populated. This in turn can be used to
escalate privileges.

Fix this by acquiring the rangelock earlier. In shm_mmap_large(),
assert that we hold the rangelock. In shm_write(), annotate an unlocked
load of shm_lp_psind.

Reported by: tsune of GMO Cybersecurity by Ierae, Inc. working with TrendAI Zero Day Initiative

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 75959
Build 72842: arc lint + arc unit

Event Timeline

markj created this revision.Fri, Aug 21, 9:42 PM
markj held this revision as a draft.
Herald added subscribers: olce, glebius, imp. · View Herald TranscriptFri, Aug 21, 9:42 PM
Harbormaster completed remote builds in B75956: Diff 184699.Fri, Aug 21, 9:42 PM
markj published this revision for review.Fri, Aug 21, 9:43 PM
markj added reviewers: kib, secteam.
markj changed the visibility from "Public (No Login Required)" to "Subscribers".
markj changed the edit policy from "All Users" to "Subscribers".
markj edited subscribers, added: secteam, kib; removed: imp, glebius, olce.

P.S. I have a patch which implements _rangelock_cookie_assert(). I'll post it once this one lands during the next SA batch.

kib added a comment.Fri, Aug 21, 10:13 PM

Please add some note in sys/mman.h to struct shmfd explaining the locking for shm_lp_XXX members.

sys/kern/uipc_shm.c
514–515

Should shm_lp_psind load moved after the rangelock acquisition?

596

I would merge all EINVAL conditions into a single if(). Or, do we intend to add EXTERRORs there?

markj updated this revision to Diff 184705.Fri, Aug 21, 10:36 PM
markj marked an inline comment as done.

Review feedback

Harbormaster completed remote builds in B75959: Diff 184705.Fri, Aug 21, 10:36 PM
markj added inline comments.Fri, Aug 21, 10:36 PM
sys/kern/uipc_shm.c
514–515

I think the unlocked load is harmless. OTOH, it is easy enough to move it.

596

I was thinking about EXTERROR, but do not want to add them in this patch. So, I just left it alone for now.

kib accepted this revision.Sat, Aug 22, 2:55 AM
This revision is now accepted and ready to land.Sat, Aug 22, 2:55 AM
Closed by commit rGb13a7008282a: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler (authored by markj). · Explain WhyTue, Aug 25, 4:00 PM
This revision was automatically updated to reflect the committed changes.
markj added a commit: rGb13a7008282a: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler.
markj added a commit: rG5990860ca841: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler.
markj added a commit: rG6bfd894c8b14: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler.
markj added a commit: rGcec488c1669b: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler.
markj added a commit: rG9c7f4633c57a: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler.
markj added a commit: rGa372e73712cf: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler.Tue, Aug 25, 4:02 PM
markj added a commit: rG840fd9dc7de2: posixshm: Fix a TOCTOU race in the FIOSSHMLPGCNF handler.Tue, Aug 25, 4:07 PM
markj changed the visibility from "Subscribers" to "Public (No Login Required)".Tue, Aug 25, 5:58 PM
markj changed the edit policy from "Subscribers" to "All Users".

Revision Contents
Changeset List

PathSize
sys/
kern/
27 lines
sys/
2 lines

Diff 184705

View Options

sys/kern/uipc_shm.c

Loading...
View Options

sys/sys/mman.h

Loading...