CVSS3
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
AI Score
Confidence
High
In the Linux kernel, the following vulnerability has been resolved:
fix bitmap corruption on close_range() with CLOSE_RANGE_UNSHARE
copy_fd_bitmaps(new, old, count) is expected to copy the first
count/BITS_PER_LONG bits from old->full_fds_bits[] and fill
the rest with zeroes. What it does is copying enough words
(BITS_TO_LONGS(count/BITS_PER_LONG)), then memsets the rest.
That works fine, if all bits past the cutoff point are
clear. Otherwise we are risking garbage from the last word
we’d copied.
For most of the callers that is true - expand_fdtable() has
count equal to old->max_fds, so there’s no open descriptors
past count, let alone fully occupied words in ->open_fds[],
which is what bits in ->full_fds_bits[] correspond to.
The other caller (dup_fd()) passes sane_fdtable_size(old_fdt, max_fds),
which is the smallest multiple of BITS_PER_LONG that covers all
opened descriptors below max_fds. In the common case (copying on
fork()) max_fds is ~0U, so all opened descriptors will be below
it and we are fine, by the same reasons why the call in expand_fdtable()
is safe.
Unfortunately, there is a case where max_fds is less than that
and where we might, indeed, end up with junk in ->full_fds_bits[] -
close_range(from, to, CLOSE_RANGE_UNSHARE) with
* descriptor table being currently shared
* ‘to’ being above the current capacity of descriptor table
* ‘from’ being just under some chunk of opened descriptors.
In that case we end up with observably wrong behaviour - e.g. spawn
a child with CLONE_FILES, get all descriptors in range 0…127 open,
then close_range(64, ~0U, CLOSE_RANGE_UNSHARE) and watch dup(0) ending
up with descriptor #128, despite #64 being observably not open.
The minimally invasive fix would be to deal with that in dup_fd().
If this proves to add measurable overhead, we can go that way, but
let’s try to fix copy_fd_bitmaps() first.
Reproducer added to tools/testing/selftests/core/close_range_test.c
git.kernel.org/stable/c/5053581fe5dfb09b58c65dd8462bf5dea71f41ff
git.kernel.org/stable/c/8cad3b2b3ab81ca55f37405ffd1315bcc2948058
git.kernel.org/stable/c/9a2fa1472083580b6c66bdaf291f591e1170123a
git.kernel.org/stable/c/c69d18f0ac7060de724511537810f10f29a27958
git.kernel.org/stable/c/dd72ae8b0fce9c0bbe9582b9b50820f0407f8d8a
git.kernel.org/stable/c/e807487a1d5fd5d941f26578ae826ca815dbfcd6
git.kernel.org/stable/c/ee501f827f3db02d4e599afbbc1a7f8b792d05d7
git.kernel.org/stable/c/fe5bf14881701119aeeda7cf685f3c226c7380df
security-tracker.debian.org/tracker/CVE-2024-45025