[LTS 9.2] net: sched: sch_qfq: Fix UAF in qfq_dequeue()

[pvts-mat]

CVE-2023-4921
VULN-6733

Problem

https://www.cve.org/CVERecord?id=CVE-2023-4921

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue()

Solution

A single commit was identified as a fix for this issue: 8fc134fee27f2263988ae38920bc03da416b03d8

kABI check: passed

python3 /mnt/code/kernel-dist-git/SOURCES/check-kabi \
-k /mnt/code/kernel-dist-git/SOURCES/Module.kabi_$(uname -m) \
-s /mnt/build_files/kernel-src-tree-ciqlts9_2-CVE-2023-4921/Module.symvers; echo $?
0

kernel-dist-git state:

Switched to branch 'el-9.2'
Your branch is up to date with 'origin/el-9.2'.

Boot test: passed

See Specific tests for implied boot test passing.

Kselftests: (in progress)

Specific tests: passed

Bug replication

The bug can be replicated with the following commands, as mention in the commit's message:

tc qdisc add dev lo root handle 1: qfq
tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
tc qdisc add dev lo parent 1:1 handle 2: plug
tc filter add dev lo parent 1: basic classid 1:1
ping -c1 127.0.0.1

The tests were performed on the referential and patched kernel.

Prerequisites

The tc commands above require the following kernel options to be enabled: CONFIG_NET_SCHED, CONFIG_NET_SCH_INGRESS, CONFIG_NET_SCH_QFQ, CONFIG_NET_SCH_PLUG, CONFIG_NET_CLS_BASIC.

This required change in the default configs/kernel-5.14.0-x86_64.config configuration file for the tested x86_64 platform.

CONFIG_NET_SCHED=y
CONFIG_NET_SCH_INGRESS=m
# CONFIG_NET_SCH_QFQ is not set
# CONFIG_NET_SCH_PLUG is not set
# CONFIG_NET_CLS_BASIC is not set

The following values were used:

CONFIG_NET_SCH_QFQ=y
CONFIG_NET_SCH_PLUG=y
CONFIG_NET_CLS_BASIC=y

Reference ciqlts9_2 (26e535ef9bf864de514c667b4f98e75354af4bde with necessary config changes)

Bug replicated successfully. Kernel crashed and machine automatically rebooted.

[root@ciqlts92 pvts]# tc qdisc add dev lo root handle 1: qfq
tc qdisc add dev lo root handle 1: qfq
[root@ciqlts92 pvts]# tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
[root@ciqlts92 pvts]# tc qdisc add dev lo parent 1:1 handle 2: plug
tc qdisc add dev lo parent 1:1 handle 2: plug
[root@ciqlts92 pvts]# tc filter add dev lo parent 1: basic classid 1:1
tc filter add dev lo parent 1: basic classid 1:1
[root@ciqlts92 pvts]# ping -c1 127.0.0.1
ping -c1 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
[ 34.471432] ------------[ cut here ]------------
[ 34.473552] kernel BUG at include/linux/skbuff.h:2420!
[ 34.475764] invalid opcode: 0000 [#1] PREEMPT SMP PTI
[ 34.477888] CPU: 9 PID: 1566 Comm: ping Kdump: loaded Not tainted 5.14.0-ciqlts9_2 #5
[ 34.481156] Hardware name: Red Hat KVM/RHEL, BIOS 1.16.3-2.el9_5.1 04/01/2014
[ 34.483633] RIP: 0010:eth_type_trans+0xd3/0x140
[ 34.484938] Code: 80 00 00 00 eb c1 8b 47 70 2b 47 74 48 8b 97 c8 00 00 00 83 f8 01 7e 1b 48 85 d2 74 06 66 83 3a ff 74 09 b8 00 04 00 00 eb a5 <0f> 0b b8 00 01 00 00 eb 9c 48 85 ff 74 eb 31 f6 b9 02 00 00 00 48
[ 34.490165] RSP: 0018:ffff9d5ac0280e80 EFLAGS: 00010a87
[ 34.491652] RAX: 0000000054488239 RBX: ffff8f7fc10e4000 RCX: ffff9d5ac0280f04
[ 34.493273] RDX: ffff8f7fc888ee64 RSI: ffff8f7fc10e4000 RDI: ffff8f7fc10a0100
[ 34.494690] RBP: ffff8f7fc10a0100 R08: ffff8f7fc47420ac R09: 0000000000000001
[ 34.496115] R10: 0000000000000004 R11: ffffffffa1a060c0 R12: 0000000000000000
[ 34.497543] R13: 0000000000000000 R14: ffff8f7fc10e4000 R15: ffff8f7fc10a0100
[ 34.498970] FS: 00007fead6210b80(0000) GS:ffff8f871fc80000(0000) knlGS:0000000000000000
[ 34.500592] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 34.501746] CR2: 00007ffcaa98e000 CR3: 00000001081ea005 CR4: 0000000000370ee0
[ 34.503062] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 34.504154] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 34.505247] Call Trace:
[ 34.505637] <IRQ>
[ 34.505963] loopback_xmit+0xbb/0x120
[ 34.506548] dev_hard_start_xmit+0xc4/0x210
[ 34.507206] sch_direct_xmit+0x9e/0x370
[ 34.507801] __qdisc_run+0x65/0xd0
[ 34.508367] net_tx_action+0x1c0/0x270
[ 34.508959] __do_softirq+0xc7/0x2ac
[ 34.509526] do_softirq+0x63/0x90
[ 34.510047] </IRQ>
[ 34.510382] <TASK>
[ 34.510719] __local_bh_enable_ip+0x5a/0x70
[ 34.511382] ip_finish_output2+0x188/0x420
[ 34.512032] ip_push_pending_frames+0xa2/0xb0
[ 34.512744] ping_v4_sendmsg+0x435/0x800
[ 34.513376] ? find_next_iomem_res+0xb2/0x110
[ 34.514067] ? release_sock+0x40/0x90
[ 34.514647] ? sock_sendmsg+0x5b/0x70
[ 34.515226] sock_sendmsg+0x5b/0x70
[ 34.515776] __sys_sendto+0xf0/0x160
[ 34.516357] ? security_file_ioctl+0x2f/0x50
[ 34.517040] __x64_sys_sendto+0x20/0x30
[ 34.517637] do_syscall_64+0x59/0x90
[ 34.518205] ? handle_mm_fault+0xc5/0x2a0
[ 34.518837] ? do_user_addr_fault+0x1dd/0x6b0
[ 34.519536] ? exc_page_fault+0x62/0x150
[ 34.520152] entry_SYSCALL_64_after_hwframe+0x63/0xcd
[ 34.520946] RIP: 0033:0x7fead614fb1a
[ 34.521517] Code: d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 f3 0f 1e fa 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 15 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 7e c3 0f 1f 44 00 00 41 54 48 83 ec 30 44 89
[ 34.524411] RSP: 002b:00007ffcaa8c9f28 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 34.525601] RAX: ffffffffffffffda RBX: 00007ffcaa8cb710 RCX: 00007fead614fb1a
[ 34.526705] RDX: 0000000000000040 RSI: 00005574cac78e00 RDI: 0000000000000003
[ 34.527827] RBP: 00005574cac78e00 R08: 00007ffcaa8cd98c R09: 0000000000000010
[ 34.528939] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000040
[ 34.530047] R13: 00007ffcaa8cb688 R14: 00007ffcaa8c9f30 R15: 00007ffcaa8cb710
[ 34.531159] </TASK>
[ 34.531513] Modules linked in: rfkill vfat fat intel_rapl_msr intel_rapl_common isst_if_common nfit libnvdimm kvm_intel iTCO_wdt kvm iTCO_vendor_support virtio_gpu irqbypass rapl virtio_dma_buf drm_shmem_helper drm_kms_helper i2c_i801 pcspkr syscopyarea i2c_smbus lpc_ich sysfillrect virtio_balloon sysimgblt fb_sys_fops joydev drm xfs libcrc32c sr_mod cdrom sg ahci libahci crct10dif_pclmul crc32_pclmul virtio_blk crc32c_intel virtio_console virtio_net net_failover ghash_clmulni_intel libata failover virtiofs serio_raw sunrpc dm_mirror dm_region_hash dm_log dm_mod fuse
[ 0.000000] Linux version 5.14.0-ciqlts9_2 (pvts@ciqlts92) (gcc (GCC) 11.3.1 20221121 (Red Hat 11.3.1-4), GNU ld version 2.35.2-37.el9) #5 SMP PREEMPT_DYNAMIC Mon Feb 10 22:07:16 UTC 2025
[ 0.000000] The list of certified hardware and cloud instances for Enterprise Linux 9 can be viewed at the Red Hat Ecosystem Catalog, https://catalog.redhat.com.
[ 0.000000] Command line: elfcorehdr=0x6f000000 BOOT_IMAGE=(hd0,gpt2)/vmlinuz-5.14.0-ciqlts9_2 ro console=ttyS0,115200n8 no_timer_check net.ifnames=0 irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 acpi_no_memhotplug transparent_hugepage=never nokaslr hest_disable novmcoredd cma=0 hugetlb_cma=0 disable_cpu_apicid=0 iTCO_wdt.pretimeout=0
...

Full log:
bug-replication–ciqlts9_2.log

Patch

Patch efficacy verified successfully. Repeating the steps doesn't result in a crash and the machine doesn't reboot.

Full log:
bug-replication–ciqlts9_2-CVE-2023-4921.log

A warning can be observed

qfq_dequeue: non-workconserving leaf

issued at sch_qfq.c. The work-conserving queue discipline is a qdisc which never leaves the outbound interface in idle unless the queue is empty, while non-work-conserving qdiscs may delay packets, for example to shape the traffic¹. The plug qdisc, being the leaf in the hierarchical qdiscs configuration used, is non-work-conserving, as it is able to suspend the packet flow. Multiple types of qdiscs are apparently not designed to work with non-work-conserving child qdiscs and issue similar warnings on skb == NULL condition: ets, hfsc, htb, drr. See also the message in b00355db3f88d96810a60011a30cfb2c3469409d

Patrick McHardy <kaber@trash.net> suggested:
> How about making this flag and the warning message (in a out-of-line
> function) globally available? Other qdiscs (f.i. HFSC) can't deal with
> inner non-work-conserving qdiscs as well.

and in 6d25d1dc76bf5943a5c1f4bb74d66d5eac58eb77, which includes qfq to the group above

A helper function for printing non-work-conserving alarms is added in
commit b00355db3f88 ("pkt_sched: sch_hfsc: sch_htb: Add non-work-conserving
warning handler."). In this commit, use qdisc_warn_nonwc() instead of
WARN_ONCE() to handle the non-work-conserving warning in qfq Qdisc.

The point is: the warning is related to the way the qdisc hierarchy has been defined in the bug replication script and not to the introduced changes.

Footnotes

¹https://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.qdisc.terminology.html

[PlaidCat]

I didn't catch this when assigning work but the CVE is not impacted on Rocky9 / RHEL9
The code is contained in CONFIG Flags that are not built by the default kernel
https://access.redhat.com/security/cve/CVE-2023-4921