oss-sec mailing list archives
[CVE-2021-3492] Ubuntu shiftfs Linux kernel file system double free vulnerability
From: Steve Beattie <steve.beattie () canonical com>
Date: Thu, 15 Apr 2021 14:33:06 -0700
Hello, Shiftfs is an out-of-tree stacking file system for the Linux kernel included in Ubuntu kernels that can be mounted by unprivileged users within unprivileged user namespaces. Vincent Dehors discovered that shiftfs, when passing through ioctls to the underlying file system, did not properly handle faults occurring during copy_from_user() correctly, leading to a double-free vulnerability or not freeing memory at all. An attacker could use this to cause a denial of service (memory consumption) or execute arbitrary code. The commits to address this issue are as follows: Ubuntu 20.10: 5c4ddd2d104e ("UBUNTU: SAUCE: shiftfs: free allocated memory in shiftfs_btrfs_ioctl_fd_replace() error paths") https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/groovy/commit/?id=5c4ddd2d104e5561724c636c9a83ab722255dc2e a92f3ddbb391 ("UBUNTU: SAUCE: shiftfs: handle copy_to_user() return values correctly") https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/groovy/commit/?id=a92f3ddbb391ce466a470e578cb24a37d7eb813c Ubuntu 20.04 LTS: 8fee52ab9da8 ("UBUNTU: SAUCE: shiftfs: free allocated memory in shiftfs_btrfs_ioctl_fd_replace() error paths") https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=8fee52ab9da87d82bc6de9ebb3480fff9b4d53e6 25c891a949bf ("UBUNTU: SAUCE: shiftfs: handle copy_to_user() return values correctly") https://git.launchpad.net/~ubuntu-kernel/ubuntu/+source/linux/+git/focal/commit/?id=25c891a949bf918b59cbc6e4932015ba4c35c333 As shiftfs has not been accepted in the upstream Linux kernel, the upstream Linux kernel is not affected by CVE-2021-3492. This issue is also identified as ZDI-CAN-13562. -- Steve Beattie <sbeattie () ubuntu com>
Attachment:
signature.asc
Description:
Current thread:
- [CVE-2021-3492] Ubuntu shiftfs Linux kernel file system double free vulnerability Steve Beattie (Apr 16)