1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /*
3 * Copyright (c) 2021 SUSE LLC <rpalethorpe@suse.com>
4 * Based on reproducer by Nicolai Stange based on PoC Andy Nguyen
5 */
6
7 /*\
8 * [Description]
9 *
10 * This will reproduce the bug on x86_64 in 32bit compatibility
11 * mode. It is most reliable with KASAN enabled. Otherwise it relies
12 * on the out-of-bounds write corrupting something which leads to a
13 * crash. It will run in other scenarious, but is not a test for the
14 * CVE.
15 *
16 * See https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
17 *
18 * Also below is Nicolai's detailed description of the bug itself.
19 *
20 * The problem underlying CVE-2021-22555 fixed by upstream commit
21 * b29c457a6511 ("netfilter: x_tables: fix compat match/target pad
22 * out-of-bound write") is that the (now removed) padding zeroing code
23 * in xt_compat_target_from_user() had been based on the premise that
24 * the user specified ->u.user.target_size, which will be considered
25 * for the target buffer allocation size, is greater or equal than
26 * what's needed to fit the corresponding xt_target instance's
27 * ->targetsize: if OTOH the user specified ->u.user.target_size is
28 * too small, then the memset() destination address calculated by
29 * adding ->targetsize to the payload start will not point at, but
30 * into or even past the padding.
31 *
32 * For the table's last entry's target record, this will result in an
33 * out-of-bounds write past the destination buffer allocated for the converted
34 * table. The code below will create a (compat) table such that the converted
35 * table's calculated size will fit exactly into a slab size of 1024 bytes and
36 * that the memset() in xt_compat_target_from_user() will write past this slab.
37 *
38 * The table will consist of
39 *
40 * * the mandatory struct compat_ipt_replace header,
41 * * a single entry consisting of
42 * ** the mandatory compat_ipt_entry header
43 * ** a single 'state' match entry of appropriate size for
44 * controlling the out-of-bounds write when converting
45 * the target entry following next,
46 * ** a single 'REJECT' target entry.
47 *
48 * The kernel will transform this into a buffer containing (in
49 * this order)
50 *
51 * * a xt_table_info
52 * * a single entry consisting of
53 * ** its ipt_entry header
54 * ** a single 'state' match entry
55 * ** followed by a single 'REJECT' target entry.
56 *
57 * The expected sizes for the 'state' match entries as well as the
58 * 'REJECT' target are the size of the base header struct (32 bytes)
59 * plus the size of an unsigned int (4 bytes) each.
60 *
61 * In the course of the compat => non-compat conversion, the kernel will insert
62 * four bytes of padding after the unsigned int payload (c.f. 'off' adjustments
63 * via xt_compat_match_offset() and xt_compat_target_offset() in
64 * xt_compat_match_from_user() and xt_compat_target_from_user() resp.).
65 *
66 * This code is based on the premise that the user sets the given
67 * ->u.user.match_size or ->u.user.target_size consistent to the
68 * COMPAT_XT_ALIGN()ed payload size as specified by the corresponding xt_match
69 * instance's ->matchsize or xt_target instance's ->targetsize.
70 *
71 * That is, the padding gets inserted unconditionally during the transformation,
72 * independent of the actual values of ->u.user.match_size or
73 * ->u.user.target_size and the result ends up getting layed out with proper
74 * alignment only if said values match the expectations.
75 *
76 * That's not a problem in itself, but this unconditional insertion of padding
77 * must be taken into account in the match_size calculation below.
78 *
79 * For the match_size calculation below, note that the chosen
80 * target slab size is 1024 and that
81 *
82 * * sizeof(xt_table_info) = 64
83 * * sizeof(ipt_entry) = 112
84 * * the kernel will insert four bytes of padding
85 * after the match and target entries each.
86 * * sizeof(struct xt_entry_target) = 32
87 */
88
89 #include <netinet/in.h>
90
91 #include "tst_test.h"
92 #include "tst_safe_net.h"
93 #include "lapi/ip_tables.h"
94
95 static void *buffer;
96
setup(void)97 void setup(void)
98 {
99 if (!tst_is_compat_mode())
100 tst_res(TINFO, "The vulnerability was only present in 32-bit compat mode");
101
102 tst_setup_netns();
103 }
104
run(void)105 void run(void)
106 {
107 const char *const res_fmt_str =
108 "setsockopt(%d, IPPROTO_IP, IPT_SO_SET_REPLACE, %p, 1)";
109 struct ipt_replace *ipt_replace = buffer;
110 struct ipt_entry *ipt_entry = &ipt_replace->entries[0];
111 struct xt_entry_match *xt_entry_match =
112 (struct xt_entry_match *)&ipt_entry->elems[0];
113 const size_t tgt_size = 32;
114 const size_t match_size = 1024 - 64 - 112 - 4 - tgt_size - 4;
115 struct xt_entry_target *xt_entry_tgt =
116 ((struct xt_entry_target *) (&ipt_entry->elems[0] + match_size));
117 int fd = SAFE_SOCKET(AF_INET, SOCK_DGRAM, 0);
118 int result;
119
120 xt_entry_match->u.user.match_size = (u_int16_t)match_size;
121 strcpy(xt_entry_match->u.user.name, "state");
122
123 xt_entry_tgt->u.user.target_size = (u_int16_t)tgt_size;
124 strcpy(xt_entry_tgt->u.user.name, "REJECT");
125
126 ipt_entry->target_offset =
127 (__builtin_offsetof(struct ipt_entry, elems) + match_size);
128 ipt_entry->next_offset = ipt_entry->target_offset + tgt_size;
129
130 strcpy(ipt_replace->name, "filter");
131 ipt_replace->num_entries = 1;
132 ipt_replace->num_counters = 1;
133 ipt_replace->size = ipt_entry->next_offset;
134
135 TEST(setsockopt(fd, IPPROTO_IP, IPT_SO_SET_REPLACE, buffer, 1));
136
137 if (TST_RET == -1 && TST_ERR == ENOPROTOOPT)
138 tst_brk(TCONF | TTERRNO, res_fmt_str, fd, buffer);
139
140 result = (TST_RET == -1 && TST_ERR == EINVAL) ? TPASS : TFAIL;
141 tst_res(result | TTERRNO, res_fmt_str, fd, buffer);
142
143 SAFE_CLOSE(fd);
144 }
145
146 static struct tst_test test = {
147 .setup = setup,
148 .test_all = run,
149 .taint_check = TST_TAINT_W | TST_TAINT_D,
150 .forks_child = 1,
151 .bufs = (struct tst_buffers []) {
152 {&buffer, .size = 2048},
153 {},
154 },
155 .needs_kconfigs = (const char *[]) {
156 "CONFIG_NETFILTER_XT_MATCH_STATE",
157 "CONFIG_IP_NF_TARGET_REJECT",
158 "CONFIG_USER_NS=y",
159 "CONFIG_NET_NS=y",
160 NULL
161 },
162 .save_restore = (const struct tst_path_val[]) {
163 {"/proc/sys/user/max_user_namespaces", "1024", TST_SR_SKIP},
164 {}
165 },
166 .tags = (const struct tst_tag[]) {
167 {"linux-git", "b29c457a6511"},
168 {"CVE", "2021-22555"},
169 {}
170 }
171 };
172