net/sched: Fix conntrack use-after-free
Affects | Status | Importance | Assigned to | Milestone | ||
---|---|---|---|---|---|---|
linux (Ubuntu) | Status tracked in Oracular | |||||
Jammy |
Fix Committed
|
High
|
gerald.yang | |||
Noble |
Fix Committed
|
High
|
gerald.yang | |||
Oracular |
Invalid
|
Undecided
|
gerald.yang | |||
linux-hwe-6.8 (Ubuntu) | Status tracked in Oracular | |||||
Jammy |
Fix Released
|
High
|
gerald.yang | |||
Noble |
Invalid
|
Undecided
|
Unassigned | |||
Oracular |
Invalid
|
Undecided
|
Unassigned |
Bug Description
BugLink: https:/
[Impact]
Hit conntrack refcount use-after-free issue:
refcount_t: addition on 0; use-after-free.
Call Trace:
<IRQ>
? show_regs+0x6d/0x80
? __warn+0x89/0x160
? refcount_
? report_
? handle_
? exc_invalid_
? asm_exc_
? refcount_
flow_offload_
tcf_ct_
tcf_ct_
tcf_action_
fl_classify+
__tcf_classify+
tcf_classify+
sch_handle_
? srso_alias_
__netif_
? __udp4_
__netif_
netif_receive_
? srso_alias_
? dev_gro_
napi_complete_
gro_cell_
__napi_
net_rx_
__do_softirq+
? srso_alias_
? handle_
? handle_
__irq_exit_
irq_exit_
common_
</IRQ>
<TASK>
[Fix]
I enabled kasan and get:
BUG: KASAN: slab-use-after-free in tcf_ct_
Read of size 1 at addr ffff888c07603600 by task handler130/6469
Call Trace:
<IRQ>
dump_stack_
print_address_
print_report+
kasan_report+
__asan_
tcf_ct_
tcf_ct_
tcf_action_
fl_classify+
__tcf_classify+
tcf_classify+
sch_handle_
__netif_
__netif_
netif_receive_
napi_complete_
gro_cell_
__napi_
net_rx_
__do_softirq+
__irq_exit_
irq_exit_
common_
</IRQ>
Allocated by task 6469:
kasan_save_
kasan_set_
kasan_save_
__kasan_
krealloc+0xaa/0x130
nf_ct_ext_
tcf_ct_
tcf_action_
fl_classify+
__tcf_classify+
tcf_classify+
sch_handle_
__netif_
__netif_
netif_receive_
napi_complete_
gro_cell_
__napi_
net_rx_
__do_softirq+
Freed by task 6469:
kasan_save_
kasan_set_
kasan_save_
____kasan_
__kasan_
slab_free_
__kmem_
kfree+0x78/0x120
nf_conntrack_
nf_ct_destroy+
__nf_ct_
nf_ct_resolve_
__nf_conntrack_
tcf_ct_
tcf_action_
fl_classify+
__tcf_classify+
tcf_classify+
sch_handle_
__netif_
__netif_
netif_receive_
napi_complete_
gro_cell_
__napi_
net_rx_
__do_softirq+
When resolving a clash, a duplicate conntrack will be freed,
but in tcf_ct_act, it still uses the freed conntrack instead of the correct conntrack.
We sent a patch to upstream to fix it and got merged:
commit 26488172b0292be
Author: Chengen Du <email address hidden>
Date: Wed Jul 10 13:37:47 2024 +0800
net/sched: Fix UAF when resolving a clash
Cherry-pick this comment to fix the conntrack slab use-after-free issue.
[Testcase]
Built a test kernel and verified on our environment which is constantly hitting this issue.
[Where problems could occur]
This patch ensure when a clash happens and the duplicated conntrack is freed,
call nf_ct_get to get the correct conntrack,
the freed conntrack won't be used and the rest of code path will follow the original path.
This won't cause other issues.
CVE References
Changed in linux (Ubuntu): | |
status: | New → In Progress |
assignee: | nobody → gerald.yang (gerald-yang-tw) |
summary: |
- [SRU] Fix conntrack use-after-free + net/sched: Fix conntrack use-after-free |
description: | updated |
Changed in linux (Ubuntu Jammy): | |
status: | New → In Progress |
Changed in linux (Ubuntu Noble): | |
status: | New → In Progress |
assignee: | nobody → gerald.yang (gerald-yang-tw) |
Changed in linux (Ubuntu Jammy): | |
assignee: | nobody → gerald.yang (gerald-yang-tw) |
description: | updated |
description: | updated |
description: | updated |
description: | updated |
Changed in linux (Ubuntu Oracular): | |
status: | In Progress → Invalid |
description: | updated |
description: | updated |
Changed in linux-hwe-6.8 (Ubuntu Noble): | |
status: | New → Invalid |
Changed in linux-hwe-6.8 (Ubuntu Oracular): | |
status: | New → Invalid |
Changed in linux-hwe-6.8 (Ubuntu Jammy): | |
importance: | Undecided → High |
status: | New → Triaged |
Changed in linux (Ubuntu Noble): | |
importance: | Undecided → High |
Changed in linux (Ubuntu Jammy): | |
importance: | Undecided → High |
Changed in linux-hwe-6.8 (Ubuntu Jammy): | |
status: | Triaged → Fix Committed |
Changed in linux (Ubuntu Noble): | |
status: | In Progress → Fix Committed |
Changed in linux (Ubuntu Jammy): | |
status: | In Progress → Fix Committed |
tags: |
added: verification-done-jammy-linux-hwe-6.8 removed: verification-needed-jammy-linux-hwe-6.8 |
Changed in linux-hwe-6.8 (Ubuntu Jammy): | |
assignee: | nobody → gerald.yang (gerald-yang-tw) |
This bug is awaiting verification that the linux-hwe- 6.8/6.8. 0-40.40~ 22.04.2 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification- needed- jammy-linux- hwe-6.8' to 'verification- done-jammy- linux-hwe- 6.8'. If the problem still exists, change the tag 'verification- needed- jammy-linux- hwe-6.8' to 'verification- failed- jammy-linux- hwe-6.8' .
If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.
See https:/ /wiki.ubuntu. com/Testing/ EnableProposed for documentation how to enable and use -proposed. Thank you!