[LTS 8.8 RT] net: sched: sch_qfq: Fix UAF in qfq_dequeue()

[pvts-mat]

CVE-2023-4921
VULN-6731

Problem

https://www.cve.org/CVERecord?id=CVE-2023-4921

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue()

Solution

A single commit was identified as a fix for this issue: 8fc134fee27f2263988ae38920bc03da416b03d8

kABI check: omitted (unstable ABI of RT kernels)

Boot test: passed

See Specific tests for implied boot test passing.

Kselftests: passed relative

Methodology

A mix of kernel-selftests-internal and source-compiled tests were used:

• kernel-selftests-internal:bpf tests, except:
  • bpf:test_kmod.sh: takes very long time to finish and always fails anyway,
  • bpf:test_progs: unstable, can crash the machine,
  • bpf:test_progs-no_alu32: unstable, can crash the machine.
• source-compiled: all the rest.

Coverage (including tests skipped during execution)

android, bpf, breakpoints, capabilities, cgroup, core, cpu-hotplug, cpufreq, drivers/net/bonding, drivers/net/team, efivarfs, exec, filesystems, firmware, fpu, ftrace, futex, gpio, intel_pstate, ipc, kcmp, kvm, lib, livepatch, membarrier, memfd, memory-hotplug, mount, mqueue, net, net/forwarding, net/mptcp, netfilter, nsfs, proc, pstore, ptrace, rseq, rtc, sgx, sigaltstack, size, splice, static_keys, sync, sysctl, tc-testing, tdx, timens, timers, tpm2, user, vm, x86, zram

Reference

Four test runs were conducted on the reference kernel.
kselftests–mixed–ciqlts8_8-rt–run1.log
kselftests–mixed–ciqlts8_8-rt–run2.log
kselftests–mixed–ciqlts8_8-rt–run3.log
kselftests–mixed–ciqlts8_8-rt–run4.log

Patch

A single rest run was conducted on the patched kernel.
kselftests–mixed–ciqlts8_8-rt-CVE-2023-4921.log

Comparison

Overview of the results, reduced to the differences:

ktests.xsh table --where "Summary = 'diff'" kselftests*.log
Column File
-------- -------------------------------------------------
Status0 kselftests--mixed--ciqlts8_8-rt--run1.log
Status1 kselftests--mixed--ciqlts8_8-rt--run2.log
Status2 kselftests--mixed--ciqlts8_8-rt--run3.log
Status3 kselftests--mixed--ciqlts8_8-rt--run4.log
Status4 kselftests--mixed--ciqlts8_8-rt-CVE-2023-4921.log
TestCase Status0 Status1 Status2 Status3 Status4 Summary
bpf:test_tcpnotify_user pass pass fail pass pass diff
kvm:hardware_disable_test pass fail pass pass pass diff
net/mptcp:simult_flows.sh fail pass pass fail pass diff
netfilter:nft_queue.sh fail fail pass fail fail diff

No differences in results occured which weren't present in the reference test set already.

One new unreliable test was identified: bpf:test_tcpnotify_user. The test may sometimes segfault, resulting in the fail status

# selftests: bpf: test_tcpnotify_user
# execute command: nc 127.0.0.1 12877 < /etc/passwd > /dev/null 2>&1 , err -2
# PASSED!
# /usr/bin/timeout: the monitored command dumped core
# ./kselftest/runner.sh: line 33: 162053 Segmentation fault /usr/bin/timeout --foreground "$kselftest_timeout" "$1"
not ok 13 selftests: bpf: test_tcpnotify_user # exit=139

Compare with the successful run

# selftests: bpf: test_tcpnotify_user
# execute command: nc 127.0.0.1 12877 < /etc/passwd > /dev/null 2>&1 , err -2
# PASSED!
ok 13 selftests: bpf: test_tcpnotify_user

Specific tests: passed

Bug replication

The bug can be replicated with the following commands, as mention in the commit's message:

tc qdisc add dev lo root handle 1: qfq
tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
tc qdisc add dev lo parent 1:1 handle 2: plug
tc filter add dev lo parent 1: basic classid 1:1
ping -c1 127.0.0.1

The tests were performed on the referential and patched kernel.

Prerequisites

The tc commands above require the following kernel options to be enabled: CONFIG_NET_SCHED, CONFIG_NET_SCH_INGRESS, CONFIG_NET_SCH_QFQ, CONFIG_NET_SCH_PLUG, CONFIG_NET_CLS_BASIC.

All of them are enabled by default in the configs/kernel-rt-4.18.0-x86_64.config configuration file for the tested x86_64 platform.

CONFIG_NET_SCHED=y
CONFIG_NET_SCH_INGRESS=m
CONFIG_NET_SCH_QFQ=m
CONFIG_NET_SCH_PLUG=m
CONFIG_NET_CLS_BASIC=m

Reference ciqlts8_8-rt (838493098c124797753ec968c5e4c6e9996e9d90)

Bug replicated successfully. Kernel crashed and machine automatically rebooted, although no crash report was observed as in the non-RT LTS 8.8 version.

[root@ciqlts8_8-rt pvts]# tc qdisc add dev lo root handle 1: qfq
tc qdisc add dev lo root handle 1: qfq
[root@ciqlts8_8-rt pvts]# tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
maxpkt 512
[root@ciqlts8_8-rt pvts]# tc qdisc add dev lo parent 1:1 handle 2: plug
tc qdisc add dev lo parent 1:1 handle 2: plug
[root@ciqlts8_8-rt pvts]# tc filter add dev lo parent 1: basic classid 1:1
tc filter add dev lo parent 1: basic classid 1:1
[root@ciqlts8_8-rt pvts]# ping -c1 127.0.0.1
ping -c1 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
[ 90.691139] ---------[ 0.000000] Linux version 4.18.0-ciqlts8_8-rt (pvts@ciqlts8_8-rt) (gcc version 8.5.0 20210514 (Red Hat 8.5.0-18) (GCC)) #2 SMP PREEMPT_RT Thu Feb 6 05:39:42 UTC 2025
[ 0.000000] Command line: elfcorehdr=0x6f000000 BOOT_IMAGE=(hd0,gpt2)/vmlinuz-4.18.0-ciqlts8_8-rt ro console=ttyS0,115200n8 no_timer_check net.ifnames=0 irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 rootflags=nofail acpi_no_memhotplug transparent_hugepage=never nokaslr novmcoredd hest_disable disable_cpu_apicid=0 iTCO_wdt.pretimeout=0
...

Full log:
bug-replication–ciqlts8_8-rt.log

Patch

Patch efficacy verified successfully. Repeating the steps doesn't result in a crash and the machine doesn't reboot.

Full log:
bug-replication–ciqlts8_8-rt-CVE-2023-4921.log

A warning can be observed

qfq_dequeue: non-workconserving leaf

issued at sch_qfq.c. The work-conserving queue discipline is a qdisc which never leaves the outbound interface in idle unless the queue is empty, while non-work-conserving qdiscs may delay packets, for example to shape the traffic¹. The plug qdisc, being the leaf in the hierarchical qdiscs configuration used, is non-work-conserving, as it is able to suspend the packet flow. Multiple types of qdiscs are apparently not designed to work with non-work-conserving child qdiscs and issue similar warnings on skb == NULL condition: ets, hfsc, htb, drr. See also the message in b00355db3f88d96810a60011a30cfb2c3469409d

Patrick McHardy <kaber@trash.net> suggested:
> How about making this flag and the warning message (in a out-of-line
> function) globally available? Other qdiscs (f.i. HFSC) can't deal with
> inner non-work-conserving qdiscs as well.

and in 6d25d1dc76bf5943a5c1f4bb74d66d5eac58eb77, which includes qfq to the group above

A helper function for printing non-work-conserving alarms is added in
commit b00355db3f88 ("pkt_sched: sch_hfsc: sch_htb: Add non-work-conserving
warning handler."). In this commit, use qdisc_warn_nonwc() instead of
WARN_ONCE() to handle the non-work-conserving warning in qfq Qdisc.

The point is: the warning is related to the way the qdisc hierarchy has been defined in the bug replication script and not to the introduced changes.

Footnotes

¹https://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.qdisc.terminology.html

[PlaidCat]

Starting github runners too

[gvrose8192]

In line with previous commits in this CVE series

[bmastbergen]

🥌