Re: [PATCH] media: dvb-core: Fix UAF due to refcount races at releasing

[Hyunwoo Kim]

Hi,

On Wed, Nov 16, 2022 at 12:08:03PM +0100, Salvatore Bonaccorso wrote:
> Hi,
> 
> On Tue, Oct 11, 2022 at 09:06:33AM +0200, Takashi Iwai wrote:
> > On Wed, 21 Sep 2022 09:34:30 +0200,
> > Takashi Iwai wrote:
> > > 
> > > On Thu, 08 Sep 2022 15:27:54 +0200,
> > > Takashi Iwai wrote:
> > > > 
> > > > The dvb-core tries to sync the releases of opened files at
> > > > dvb_dmxdev_release() with two refcounts: dvbdev->users and
> > > > dvr_dvbdev->users.  A problem is present in those two syncs: when yet
> > > > another dvb_demux_open() is called during those sync waits,
> > > > dvb_demux_open() continues to process even if the device is being
> > > > closed.  This includes the increment of the former refcount, resulting
> > > > in the leftover refcount after the sync of the latter refcount at
> > > > dvb_dmxdev_release().  It ends up with use-after-free, since the
> > > > function believes that all usages were gone and releases the
> > > > resources.
> > > > 
> > > > This patch addresses the problem by adding the check of dmxdev->exit
> > > > flag at dvb_demux_open(), just like dvb_dvr_open() already does.  With
> > > > the exit flag check, the second call of dvb_demux_open() fails, hence
> > > > the further corruption can be avoided.
> > > > 
> > > > Also for avoiding the races of the dmxdev->exit flag reference, this
> > > > patch serializes the dmxdev->exit set up and the sync waits with the
> > > > dmxdev->mutex lock at dvb_dmxdev_release().  Without the mutex lock,
> > > > dvb_demux_open() (or dvb_dvr_open()) may run concurrently with
> > > > dvb_dmxdev_release(), which allows to skip the exit flag check and
> > > > continue the open process that is being closed.
> > > > 
> > > > Reported-by: Hyunwoo Kim <imv4bel@xxxxxxxxx>
> > > > Cc: <stable@xxxxxxxxxxxxxxx>
> > > > Signed-off-by: Takashi Iwai <tiwai@xxxxxxx>
> > > 
> > > Any review on this?
> > > 
> > > FWIW, now CVE-2022-41218 is assigned for those bugs as a security
> > > issue.
> > 
> > A gentle ping again.
> > 
> > Or if any other fix for this security issue is already available,
> > please let me know.
> 
> is this correct, the fix is yet missing (or was it fixed by other
> means?).

This patch has been re-send and has been missing for a long time:
https://lore.kernel.org/linux-media/20221031100245.23702-1-tiwai@xxxxxxx/

However, I noticed yesterday that the status of the re-send patch 
changed to 'accpet':
https://patchwork.linuxtv.org/project/linux-media/patch/20221031100245.23702-1-tiwai@xxxxxxx/

But there was no other feedback.


Regards,
Hyunwoo Kim