Vulnerability: fs/namei.c in the Linux kernel before 5.5 has a may_create_in_sticky use-after-free, which allows local users to cause a denial of service (OOPS) or possibly obtain sensitive information from kernel memory, aka CID-d0cb50185ae9. One attack vector may be an open system call for a UNIX domain socket, if the socket is being moved to a new parent directory and its old parent directory is being removed.
Vulnerability ID: CVE-2020-8428
CWE: CWE-416
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2020-01-29
File: fs/namei.c
Commit message: do_last(): fetch directory ->i_mode and ->i_uid before it's too late

may_create_in_sticky() call is done when we already have dropped the
reference to dir.

Fixes: 30aba6656f61e (namei: allow restricted O_CREAT of FIFOs and regular files)
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Commit author: Al Viro

Vulnerable version (before fix):
 static int may_linkat(struct path *link)  * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory  *			  should be allowed, or not, on files that already  *			  exist.  * @dir: the sticky parent directory  * @inode: the inode of the file to open  *  * Block an O_CREAT open of a FIFO (or a regular file) when: static int may_linkat(struct path *link)  *  * Returns 0 if the open is allowed, -ve on error.  */ static int may_create_in_sticky(struct dentry * const dir, 				struct inode * const inode) { 	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) || 	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) || 	    likely(!(dir->d_inode->i_mode & S_ISVTX)) || 	    uid_eq(inode->i_uid, dir->d_inode->i_uid) || 	    uid_eq(current_fsuid(), inode->i_uid)) 		return 0;  	if (likely(dir->d_inode->i_mode & 0002) || 	    (dir->d_inode->i_mode & 0020 && 	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || 	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { 		const char *operation = S_ISFIFO(inode->i_mode) ? static int do_last(struct nameidata *nd, 		   struct file *file, const struct open_flags *op) { 	struct dentry *dir = nd->path.dentry; 	int open_flag = op->open_flag; 	bool will_truncate = (open_flag & O_TRUNC) != 0; 	bool got_write = false; static int do_last(struct nameidata *nd, 		error = -EISDIR; 		if (d_is_dir(nd->path.dentry)) 			goto out; 		error = may_create_in_sticky(dir, 					     d_backing_inode(nd->path.dentry)); 		if (unlikely(error)) 			goto out;

Fixed version (after fix):
 static int may_linkat(struct path *link)  * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory  *			  should be allowed, or not, on files that already  *			  exist.  * @dir_mode: mode bits of directory  * @dir_uid: owner of directory  * @inode: the inode of the file to open  *  * Block an O_CREAT open of a FIFO (or a regular file) when: static int may_linkat(struct path *link)  *  * Returns 0 if the open is allowed, -ve on error.  */ static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid, 				struct inode * const inode) { 	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) || 	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) || 	    likely(!(dir_mode & S_ISVTX)) || 	    uid_eq(inode->i_uid, dir_uid) || 	    uid_eq(current_fsuid(), inode->i_uid)) 		return 0;  	if (likely(dir_mode & 0002) || 	    (dir_mode & 0020 && 	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) || 	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) { 		const char *operation = S_ISFIFO(inode->i_mode) ? static int do_last(struct nameidata *nd, 		   struct file *file, const struct open_flags *op) { 	struct dentry *dir = nd->path.dentry; 	kuid_t dir_uid = dir->d_inode->i_uid; 	umode_t dir_mode = dir->d_inode->i_mode; 	int open_flag = op->open_flag; 	bool will_truncate = (open_flag & O_TRUNC) != 0; 	bool got_write = false; static int do_last(struct nameidata *nd, 		error = -EISDIR; 		if (d_is_dir(nd->path.dentry)) 			goto out; 		error = may_create_in_sticky(dir_mode, dir_uid, 					     d_backing_inode(nd->path.dentry)); 		if (unlikely(error)) 			goto out;

Patch:
patch: @@ -1001,7 +1001,8 @@ static int may_linkat(struct path *link)
  * may_create_in_sticky - Check whether an O_CREAT open in a sticky directory
  *			  should be allowed, or not, on files that already
  *			  exist.
- * @dir: the sticky parent directory
+ * @dir_mode: mode bits of directory
+ * @dir_uid: owner of directory
  * @inode: the inode of the file to open
  *
  * Block an O_CREAT open of a FIFO (or a regular file) when:
@@ -1017,18 +1018,18 @@ static int may_linkat(struct path *link)
  *
  * Returns 0 if the open is allowed, -ve on error.
  */
-static int may_create_in_sticky(struct dentry * const dir,
+static int may_create_in_sticky(umode_t dir_mode, kuid_t dir_uid,
 				struct inode * const inode)
 {
 	if ((!sysctl_protected_fifos && S_ISFIFO(inode->i_mode)) ||
 	    (!sysctl_protected_regular && S_ISREG(inode->i_mode)) ||
-	    likely(!(dir->d_inode->i_mode & S_ISVTX)) ||
-	    uid_eq(inode->i_uid, dir->d_inode->i_uid) ||
+	    likely(!(dir_mode & S_ISVTX)) ||
+	    uid_eq(inode->i_uid, dir_uid) ||
 	    uid_eq(current_fsuid(), inode->i_uid))
 		return 0;
 
-	if (likely(dir->d_inode->i_mode & 0002) ||
-	    (dir->d_inode->i_mode & 0020 &&
+	if (likely(dir_mode & 0002) ||
+	    (dir_mode & 0020 &&
 	     ((sysctl_protected_fifos >= 2 && S_ISFIFO(inode->i_mode)) ||
 	      (sysctl_protected_regular >= 2 && S_ISREG(inode->i_mode))))) {
 		const char *operation = S_ISFIFO(inode->i_mode) ?
@@ -3201,6 +3202,8 @@ static int do_last(struct nameidata *nd,
 		   struct file *file, const struct open_flags *op)
 {
 	struct dentry *dir = nd->path.dentry;
+	kuid_t dir_uid = dir->d_inode->i_uid;
+	umode_t dir_mode = dir->d_inode->i_mode;
 	int open_flag = op->open_flag;
 	bool will_truncate = (open_flag & O_TRUNC) != 0;
 	bool got_write = false;
@@ -3331,7 +3334,7 @@ static int do_last(struct nameidata *nd,
 		error = -EISDIR;
 		if (d_is_dir(nd->path.dentry))
 			goto out;
-		error = may_create_in_sticky(dir,
+		error = may_create_in_sticky(dir_mode, dir_uid,
 					     d_backing_inode(nd->path.dentry));
 		if (unlikely(error))
 			goto out;
path: fs/namei.c