[CVE-2023-42755] Linux kernel wild pointer access <= v6.2

[Kyle Zeng <zengyhkyle () gmail com>]

Hi there,

I recently found a bug in the rsvp traffic classifier in the Linux kernel.
This classifier is already retired in the upstream but affects all stable
releases. More specifically, this bug affects v6.1, v5.15, v5.10, v5.4,
v4.19, and v4.14.

The symptom of the bug is that the kernel can be tricked into accessing a
wild pointer, thus crash the kernel.

[Root Cause]
The root cause of the bug is an slab-out-of-bound access, but since the
offset to the original pointer is an `unsigned int` fully controlled by
users, the behaviour is ususally a wild pointer access.

in `rsvp_change`, RSVP_PINFO is passed to the kernel without any checks
~~~
static int rsvp_change(...)
{
        ......
        if (tb[TCA_RSVP_PINFO]) {
                pinfo = nla_data(tb[TCA_RSVP_PINFO]);
                f->spi = pinfo->spi;
                f->tunnelhdr = pinfo->tunnelhdr;
        }
        ......
        if (pinfo) {
                s->dpi = pinfo->dpi;
                s->protocol = pinfo->protocol;
                s->tunnelid = pinfo->tunnelid;
        }
        ......
}
~~~

As a result, later when the classifier actually does the classification
in `rsvp_classify`:
~~~
TC_INDIRECT_SCOPE int RSVP_CLS(struct sk_buff *skb, const struct tcf_proto *tp,
                               struct tcf_result *res)
{
        ......
        *(u32 *)(xprt + s->dpi.offset) ^ s->dpi.key)
        ......
}
~~~
`xprt + s->dpi.offset` becomes a wild pointer and crashes the kernel.

[Severity]
This will cause a local denial-of-service.

[Patch]
The patch is to follow the upstream and retire the rsvp classifier in
all the stable trees.
And it is queued in all the stable trees, but not merged yet.
For example, the patch for v6.1 can be found here:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/stable-queue.git/diff/queue-6.1/net-sched-retire-rsvp-classifier.patch?id=f75b6fc19b6ec061f59b4e18d72ebb32ceea8587

[Affected Version]
I confirmed that this bug affects v6.2, v6.1, v5.15, v5.10, v5.4,
v4.19, and v4.14.

[Proof-of-Concept]
A PoC file is attached to this email.

[Splash]
A kernel oops splash is attached to this email.

This issue is assigned with CVE-2023-42755.

Best,
Kyle Zeng

Attachment: poc.c
Description:

Attachment: splash
Description: