oss-sec mailing list archives
CVE-2021-3483: Linux kernel: a use-after-free bug in nosy driver
From: 马哲宇 <zheyuma97 () gmail com>
Date: Wed, 7 Apr 2021 19:16:07 +0800
Hello, I found a bug in the latest Linux kernel. The location of the bug is Linux/drivers/firewire/nosy.c. Nosy is an IEEE 1394 packet sniffer which is used for protocol analysis and in the development of IEEE 1394 drivers, applications, or firmware. For each device, the nosy driver allocates a pcilynx structure. A use-after-free might happen in the following scenario: 1. Open nosy device for the first time and call ioctl with command NOSY_IOC_START, then a new client A will be malloced and added to doubly linked list. 2. Open nosy device for the second time and call ioctl with command NOSY_IOC_START, then a new client B will be malloced and added to doubly linked list. 3. Call ioctl with command NOSY_IOC_START for client A, then client A will be readded to the doubly linked list. Now the doubly linked list is messed up. 4. Close the first nosy device and nosy_release will be called. In nosy_release, client A will be unlinked and freed. 5. Close the second nosy device, and client A will be referenced, resulting in UAF. The root cause of this bug is that the element in the doubly linked list is reentered into the list. Here is the commit to patch this BUG: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=829933ef05a951c8ff140e814656d73e74915faf Regards, Zheyu Ma
Current thread:
- CVE-2021-3483: Linux kernel: a use-after-free bug in nosy driver 马哲宇 (Apr 07)