CVE-2022-33981 (Other, published 2022-06-18T16:15Z)
Description: value: drivers/block/floppy.c in the Linux kernel before 5.17.6 is vulnerable to a denial of service, because of a concurrency use-after-free flaw after deallocating raw_cmd in the raw_cmd_ioctl function.
Severity: LOW (CVSS v3 base score: 3.3)
Weakness: CWE-416 \u2014 Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Repository: https://github.com/torvalds/linux
Files changed:
drivers/block/Kconfig
drivers/block/floppy.c
Commit message: floppy: disable FDRAWCMD by default

Minh Yuan reported a concurrency use-after-free issue in the floppy code
between raw_cmd_ioctl and seek_interrupt.

[ It turns out this has been around, and that others have reported the
  KASAN splats over the years, but Minh Yuan had a reproducer for it and
  so gets primary credit for reporting it for this fix   - Linus ]

The problem is, this driver tends to break very easily and nowadays,
nobody is expected to use FDRAWCMD anyway since it was used to
manipulate non-standard formats.  The risk of breaking the driver is
higher than the risk presented by this race, and accessing the device
requires privileges anyway.

Let's just add a config option to completely disable this ioctl and
leave it disabled by default.  Distros shouldn't use it, and only those
running on antique hardware might need to enable it.

Link: https://lore.kernel.org/all/000000000000b71cdd05d703f6bf@google.com/
Link: https://lore.kernel.org/lkml/CAKcFiNC=MfYVW-Jt9A3=FPJpTwCD2PL_ULNCpsCVE5s8ZeBQgQ@mail.gmail.com
Link: https://lore.kernel.org/all/CAEAjamu1FRhz6StCe_55XY5s389ZP_xmCF69k987En+1z53=eg@mail.gmail.com
Reported-by: Minh Yuan <yuanmingbuaa@gmail.com>
Reported-by: syzbot+8e8958586909d62b6840@syzkaller.appspotmail.com
Reported-by: cruise k <cruise4k@gmail.com>
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Suggested-by: Linus Torvalds <torvalds@linuxfoundation.org>
Tested-by: Denis Efremov <efremov@linux.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>


Vulnerable code:
	int i;
		if (type)
			return -EINVAL;
		if (lock_fdc(drive))
			return -EINTR;
		set_floppy(drive);
		i = raw_cmd_ioctl(cmd, (void __user *)param);
		if (i == -EINTR)
			return -EINTR;
		process_fd_request();
		return i;

Fixed code:
config BLK_DEV_FD_RAWCMD
	bool "Support for raw floppy disk commands (DEPRECATED)"
	depends on BLK_DEV_FD
	help
	  If you want to use actual physical floppies and expect to do
	  special low-level hardware accesses to them (access and use
	  non-standard formats, for example), then enable this.

	  Note that the code enabled by this option is rarely used and
	  might be unstable or insecure, and distros should not enable it.

	  Note: FDRAWCMD is deprecated and will be removed from the kernel
	  in the near future.

	  If unsure, say N.

#ifdef CONFIG_BLK_DEV_FD_RAWCMD

static int floppy_raw_cmd_ioctl(int type, int drive, int cmd,
				void __user *param)
{
	int ret;

	pr_warn_once("Note: FDRAWCMD is deprecated and will be removed from the kernel in the near future.\n");

	if (type)
		return -EINVAL;
	if (lock_fdc(drive))
		return -EINTR;
	set_floppy(drive);
	ret = raw_cmd_ioctl(cmd, param);
	if (ret == -EINTR)
		return -EINTR;
	process_fd_request();
	return ret;
}

#else /* CONFIG_BLK_DEV_FD_RAWCMD */

static int floppy_raw_cmd_ioctl(int type, int drive, int cmd,
				void __user *param)
{
	return -EOPNOTSUPP;
}

#endif

		return floppy_raw_cmd_ioctl(type, drive, cmd, (void __user *)param);