kernelCTF: add CVE-2023-5197_lts_cos_2 #275
Conversation
|
Hey! This exp100 is a vulnerability dupe of exp99 and based on the kernelCTF rules it's ineligible for reward.
They both exploit the vulnerability with patch commit netfilter: nf_tables: disallow rule removal from chain binding but exp99 was submitted earlier (2023-09-06) than your exp100 (2023-09-13). Let us know if there was some misunderstanding and this submission should be eligible. See our public spreadsheet for the submission details. |
|
Hi @koczkatamas, per an email discussion we made before,
So I believe this should be eligible for a COS reward. I have emailed you as a reply to that email thread. Sorry for submitting this so late and caused confusions. |
| - Create a new table, a victim chain, a spray chain, and a primitive chain. | ||
| - Add one rule to the primitive chain whose immediate expression jumps to the victim chain. This holds a reference to the victim. | ||
| - `vuln_trigger`: | ||
| - Create an “effect” chain with a rule that jumps to the victim; delete that rule in the same transaction; then create another chain with a rule referencing the effect chain and delete that, triggering deactivation traversal again. |
There was a problem hiding this comment.
Is the "another" chain called "attacker" chain in the code? Is it deleted in separate transaction or in the same with previous rule? Could elaborate on this more.
|
|
||
| - The exploit abuses `nf_tables` transaction semantics and chain/rule deactivation to cause a UAF on an `nft_chain`: | ||
| - A chain (“victim chain”) is referenced by an `immediate1 jump expression in a rule of another chain (“primitive chain”), which increments its use count. | ||
| - Through a crafted sequence of creating and deleting rules/chains in the same transaction, the PoC causes deactivation to run against a chain twice in a way that decrements the victim chain’s use count back to zero while a stale reference still exists in the primitive chain. |
There was a problem hiding this comment.
Could you elaborate which functions in kernel code are triggered by this? Could you show which code parts (before patch) allowed this behaviour which resulted in vulnerability?
|
|
||
| Conceptually, it is a refcount/lifetime bug: insufficient synchronization between rule list traversal during deactivation and the generation/use-count model for chains across a transaction. | ||
|
|
||
| Note: For LTS instance running on 6.1 kernel, `nf_tables` objects are allocated with `GFP_KERNEL_ACCOUNT`, so they will use `kmalloc-cg-*` caches instead. |
There was a problem hiding this comment.
What about COS? Is it the same?
| ## CVE-2023-5197 | ||
|
|
||
| - The exploit abuses `nf_tables` transaction semantics and chain/rule deactivation to cause a UAF on an `nft_chain`: | ||
| - A chain (“victim chain”) is referenced by an `immediate1 jump expression in a rule of another chain (“primitive chain”), which increments its use count. |
There was a problem hiding this comment.
Please add the details on which ref count you're targeting, which kernel structure contains it?
| 1) Establish the UAF primitive | ||
| - `vuln_setup(..., victim="c_free", primitive_is_base_chain=false)`: | ||
| - Create a new table, a victim chain, a spray chain, and a primitive chain. | ||
| - Add one rule to the primitive chain whose immediate expression jumps to the victim chain. This holds a reference to the victim. |
There was a problem hiding this comment.
Is this an immediate expression with verdict to jump? Could you elaborate a bit more on structure of this object.
| - This sequence decrements victim->use back to zero. | ||
| - Then delete the victim chain in a follow-up batch. The primitive chain still has a rule that jumps to the now-freed victim chain, creating the UAF. | ||
|
|
||
| 2) Spray `kmalloc-128` with `nft_rule` objects |
There was a problem hiding this comment.
Is the "chain" object fits into `kmalloc-128? What is the size of the chain objects you create?
artmetla
left a comment
artmetla
left a comment
There was a problem hiding this comment.
Hey @kungfulon,
Please review my comments and add necessary information to the exploit description
3 participants
No description provided.