Hi Greg,
I recently found a bug in the rsvp traffic classifier in the Linux kernel. This classifier is already retired in the upstream but affects stable releases.
The symptom of the bug is that the kernel can be tricked into accessing a wild pointer, thus crash the kernel.
Since it is just a crash and cannot be used for LPE, I do not want to trouble security@kernel.org. And since the classifier is already retired in the upstream, I cannot report there.
Since it affects stable releases, I decided to report it here. If it is not appropriate, I appologize in advance and wonder what will be a good channel to report bugs that only affects stable releases and no equivalent fix exists in the upstream.
[Root Cause] The root cause of the bug is an slab-out-of-bound access, but since the offset to the original pointer is an `unsign int` fully controlled by users, the behaviour is ususally a wild pointer access.
in `rsvp_change`, RSVP_PINFO is passed to the kernel without any checks ~~~ static int rsvp_change(...) { ...... if (tb[TCA_RSVP_PINFO]) { pinfo = nla_data(tb[TCA_RSVP_PINFO]); f->spi = pinfo->spi; f->tunnelhdr = pinfo->tunnelhdr; } ...... if (pinfo) { s->dpi = pinfo->dpi; s->protocol = pinfo->protocol; s->tunnelid = pinfo->tunnelid; } ...... } ~~~
As a result, later when the classifier actually does the classification in `rsvp_classify`: ~~~ TC_INDIRECT_SCOPE int RSVP_CLS(struct sk_buff *skb, const struct tcf_proto *tp, struct tcf_result *res) { ...... *(u32 *)(xprt + s->dpi.offset) ^ s->dpi.key) ...... } ~~~ `xprt + s->dpi.offset` becomes a wild pointer and crashes the kernel.
[Severity] This will cause a local denial-of-service.
[Patch] I don't know enough about this subsystem to suggest a proper patch. But I will suggest to retire rsvp classifier completely just like in the upstream.
[Affected Version] I confirmed that this bug affects v5.10, v6.1, and v6.2.
[Proof-of-Concept] A POC file is attached to this email.
[Splash] A kernel oops splash is attached to this email.
Best, Kyle Zeng