Page MenuHomeFreeBSD

dsp: Fix a potential use-after-free in dsp_oss_syncstart()
ClosedPublic

Authored by markj on Tue, Aug 18, 5:00 PM.
Tags
None
Referenced Files
F168873645: D58912.id.diff
Sun, Aug 30, 1:36 PM
Unknown Object (File)
Sat, Aug 29, 3:15 PM
Unknown Object (File)
Sat, Aug 29, 1:51 PM
Unknown Object (File)
Sat, Aug 29, 9:47 AM
Unknown Object (File)
Sat, Aug 29, 8:53 AM
Unknown Object (File)
Fri, Aug 28, 4:00 AM
Unknown Object (File)
Wed, Aug 26, 4:43 PM
Unknown Object (File)
Wed, Aug 26, 4:41 PM
Subscribers

Details

Summary

This function has a loop where it attempts to lock all channels in a
group. If doing so would block, it releases all locks, sleeps for a
bit, and tries again. However, once the syncgroup lock is dropped,
nothing prevents the syncgroup structure from being freed.

This bug can be exploited to get escalate privileges. Reliable exploitation
likely requires access to more than one PCM device.

Fix the inner loop: after waking up, break out of it unconditionally and
start everything again. I think the old code was also buggy and not
well-exercised: after waking up we'd continue to try and continue
locking channels. Then we'd try again from the beginning and fail to
lock the channels we had already locked.

Reported by: Hazley Samsudin of GovTech CSG

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

markj held this revision as a draft.
markj changed the visibility from "Public (No Login Required)" to "Subscribers".Tue, Aug 18, 5:00 PM
markj changed the edit policy from "All Users" to "Subscribers".
markj published this revision for review.Tue, Aug 18, 5:03 PM
markj edited the summary of this revision. (Show Details)
markj added reviewers: secteam, christos.
markj edited subscribers, added: secteam, christos; removed: imp.
This revision is now accepted and ready to land.Tue, Aug 18, 8:21 PM

Please also add an MFC date for this.

Please also add an MFC date for this.

This is going to be committed during our next batch of security advisories, so it'll be insta-MFCed.

markj changed the visibility from "Subscribers" to "Public (No Login Required)".Tue, Aug 25, 5:59 PM
markj changed the edit policy from "Subscribers" to "All Users".