ZDI-CAN-10904: QEMU Plan 9 File System TOCTOU Privilege Escalation Vulnerability
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
QEMU |
Fix Released
|
Undecided
|
Greg Kurz |
Bug Description
-- CVSS -------
7.5: AV:L/AC:
-- ABSTRACT -------
Trend Micro's Zero Day Initiative has identified a vulnerability affecting the following products:
QEMU - QEMU
-- VULNERABILITY DETAILS -------
Version tested:5.0.0-rc3
Installer file:qemu-
Platform tested:ubuntu 18.04 x64 desktop
Analysis Basically v9fs* functions called from guest kernel are executed under specific thread(I call it main thread later). But when it calls some file related system calls, qemu uses its own coroutine thread(worker thread). Then it returns(yield return) without waiting result of system call and start to execute next v9fs* function.
In v9fsmarkfidsunr
-> https:/
And if it uses coroutine, it restore fid_list from stack and restart whole loop.
-> https:/
v9fsclunk() function calls clunkfid() which unlink fid from list, and free it.
-> https:/
So if v9fsclunk() is called while v9fsmarkfidsunr
it can be reproduced with the qemu binary, which is given
it can also be reproduced with own ASAN build (5.0.0-rc3 and 4.2.0 are tested)
../qemu-
$ ./do.sh
expected ASAN report is printed
the race is in coroutine, so the threads are the same one
=======
==46645==ERROR: AddressSanitizer: heap-use-after-free on address 0x610000047948 at pc 0x5563d8c28f0f bp0
READ of size 2 at 0x610000047948 thread T0
#0 0x5563d8c28f0e in v9fs_mark_
#1 0x5563d8c3e9e3 in v9fs_remove hw/9pfs/9p.c:2988
#2 0x5563d98d310d in coroutine_
#3 0x7fadac6396af (/lib/x86_
0x610000047948 is located 8 bytes inside of 192-byte region [0x610000047940
#0 0x7fadafa5f7a8 in __interceptor_free (/usr/lib/
#1 0x5563d8c27a60 in free_fid hw/9pfs/9p.c:371
#2 0x5563d8c27fcc in put_fid hw/9pfs/9p.c:396
#3 0x5563d8c37267 in v9fs_clunk hw/9pfs/9p.c:2085
#4 0x5563d98d310d in coroutine_
#5 0x7fadac6396af (/lib/x86_
previously allocated by thread T0 here:
#0 0x7fadafa5fd28 in __interceptor_
#1 0x7fadaf0c8b10 in g_malloc0 (/usr/lib/
#2 0x5563d8c30ecc in v9fs_attach hw/9pfs/9p.c:1412
#3 0x5563d98d310d in coroutine_
#4 0x7fadac6396af (/lib/x86_
This vulnerability was discovered by:
Ryota Shiga(@Garyo) of Flatt Security working with Trend Micro Zero Day Initiative
CVE References
Changed in qemu: | |
status: | New → Confirmed |
assignee: | nobody → Greg Kurz (gkurz) |
Changed in qemu: | |
status: | Confirmed → In Progress |
Changed in qemu: | |
status: | Fix Committed → Fix Released |
Requesting a CVE...