Bugzilla – Bug 558267
VUL-1: kernel: Linux kernel: bug in wireless allows remote denial of service
Last modified: 2018-07-03 20:21:03 UTC
Hi. There is a security bug in 'kernel'. This information is from 'vendor-sec'. This bug is public. There is no coordinated release date (CRD) set. Original posting: ----- Forwarded message from Johannes Berg <johannes@sipsolutions.net> ----- From: Johannes Berg <johannes@sipsolutions.net> To: vendor-sec@lst.de Cc: John Linville <linville@tuxdriver.com>, Eugene Teo <eugene@redhat.com>, Greg K-H <greg@kroah.com> Date: Tue, 24 Nov 2009 17:30:03 +0100 Subject: [vendor-sec] Linux kernel: bug in wireless Errors-To: vendor-sec-admin@lst.de Hi, There's a bug in the linux wireless code that leads to the system crashing in a BUG_ON() for many wireless drivers upon reception of a spurious delba frame that comes (or rather pretends to come) from the current AP. It's not, as far as I can tell, exploitable in the sense of running arbitrary code. I have no idea how this should be handled -- help/hints welcome. Attached are patches against Linux 2.6.32 and 2.6.31, but the problem dates back to 2.6.29 I think, but I haven't generated patches for those versions -- it should be fairly simple though. I have a trivial "exploit" program as well that I've used to check the existence of the problem in a few scenarios. johannes Subject: mac80211: fix spurious delBA handling Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was commit d75636ef9c1af224f1097941879d5a8db7cd04e5 Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Feb 10 21:25:53 2009 +0100 mac80211: RX aggregation: clean up stop session and other parts were already present in the original commit d92684e66091c0f0101819619b315b4bb8b5bcc5 Author: Ron Rindjunsky <ron.rindjunsky@intel.com> Date: Mon Jan 28 14:07:22 2008 +0200 mac80211: A-MPDU Tx add delBA from recipient support The first problem is that I moved a BUG_ON before various checks -- thereby making it possible to hit. As the comment indicates, the BUG_ON can be removed since the ampdu_action callback must already exist when the state is != IDLE. The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARN_ON may happen with non-HT drivers, while the race opens only for HT drivers. For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock 2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already. Reported-by: Lennert Buytenhek <buytenh@wantstofly.org> Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes@sipsolutions.net> --- drivers/net/wireless/iwlwifi/iwl-tx.c | 10 +++++++++- include/net/mac80211.h | 6 ++++++ net/mac80211/agg-rx.c | 4 ---- net/mac80211/agg-tx.c | 15 +++++++-------- net/mac80211/ht.c | 8 +++----- net/mac80211/ieee80211_i.h | 2 ++ 6 files changed, 27 insertions(+), 18 deletions(-) --- iwlwifi-2.6.orig/drivers/net/wireless/iwlwifi/iwl-tx.c 2009-11-22 12:26:25.000000000 +0100 +++ iwlwifi-2.6/drivers/net/wireless/iwlwifi/iwl-tx.c 2009-11-22 12:28:45.000000000 +0100 @@ -1233,8 +1233,16 @@ int iwl_tx_agg_stop(struct iwl_priv *pri return -ENXIO; } + if (priv->stations[sta_id].tid[tid].agg.state == + IWL_EMPTYING_HW_QUEUE_ADDBA) { + IWL_DEBUG_HT(priv, "AGG stop before setup done\n"); + ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid); + priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF; + return 0; + } + if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON) - IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n"); + IWL_WARN(priv, "Stopping AGG while state not ON or starting\n"); tid_data = &priv->stations[sta_id].tid[tid]; ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4; --- iwlwifi-2.6.orig/include/net/mac80211.h 2009-11-22 12:27:16.000000000 +0100 +++ iwlwifi-2.6/include/net/mac80211.h 2009-11-22 12:28:45.000000000 +0100 @@ -1244,6 +1244,12 @@ enum ieee80211_filter_flags { * * These flags are used with the ampdu_action() callback in * &struct ieee80211_ops to indicate which action is needed. + * + * Note that drivers MUST be able to deal with a TX aggregation + * session being stopped even before they OK'ed starting it by + * calling ieee80211_start_tx_ba_cb(_irqsafe), because the peer + * might receive the addBA frame and send a delBA right away! + * * @IEEE80211_AMPDU_RX_START: start Rx aggregation * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation * @IEEE80211_AMPDU_TX_START: start Tx aggregation --- iwlwifi-2.6.orig/net/mac80211/agg-rx.c 2009-11-22 12:24:02.000000000 +0100 +++ iwlwifi-2.6/net/mac80211/agg-rx.c 2009-11-22 12:28:45.000000000 +0100 @@ -85,10 +85,6 @@ void ieee80211_sta_stop_rx_ba_session(st struct ieee80211_local *local = sdata->local; struct sta_info *sta; - /* stop HW Rx aggregation. ampdu_action existence - * already verified in session init so we add the BUG_ON */ - BUG_ON(!local->ops->ampdu_action); - rcu_read_lock(); sta = sta_info_get(local, ra); --- iwlwifi-2.6.orig/net/mac80211/agg-tx.c 2009-11-22 12:27:24.000000000 +0100 +++ iwlwifi-2.6/net/mac80211/agg-tx.c 2009-11-22 12:28:45.000000000 +0100 @@ -123,13 +123,18 @@ void ieee80211_send_bar(struct ieee80211 ieee80211_tx_skb(sdata, skb, 0); } -static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, - enum ieee80211_back_parties initiator) +int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + enum ieee80211_back_parties initiator) { struct ieee80211_local *local = sta->local; int ret; u8 *state; +#ifdef CONFIG_MAC80211_HT_DEBUG + printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n", + sta->sta.addr, tid); +#endif /* CONFIG_MAC80211_HT_DEBUG */ + state = &sta->ampdu_mlme.tid_state_tx[tid]; if (*state == HT_AGG_STATE_OPERATIONAL) @@ -143,7 +148,6 @@ static int ___ieee80211_stop_tx_ba_sessi /* HW shall not deny going back to legacy */ if (WARN_ON(ret)) { - *state = HT_AGG_STATE_OPERATIONAL; /* * We may have pending packets get stuck in this case... * Not bothering with a workaround for now. @@ -526,11 +530,6 @@ int __ieee80211_stop_tx_ba_session(struc goto unlock; } -#ifdef CONFIG_MAC80211_HT_DEBUG - printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n", - sta->sta.addr, tid); -#endif /* CONFIG_MAC80211_HT_DEBUG */ - ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator); unlock: --- iwlwifi-2.6.orig/net/mac80211/ht.c 2009-11-22 12:27:24.000000000 +0100 +++ iwlwifi-2.6/net/mac80211/ht.c 2009-11-22 12:28:45.000000000 +0100 @@ -141,7 +141,6 @@ void ieee80211_process_delba(struct ieee struct sta_info *sta, struct ieee80211_mgmt *mgmt, size_t len) { - struct ieee80211_local *local = sdata->local; u16 tid, params; u16 initiator; @@ -161,10 +160,9 @@ void ieee80211_process_delba(struct ieee WLAN_BACK_INITIATOR, 0); else { /* WLAN_BACK_RECIPIENT */ spin_lock_bh(&sta->lock); - sta->ampdu_mlme.tid_state_tx[tid] = - HT_AGG_STATE_OPERATIONAL; + if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK) + ___ieee80211_stop_tx_ba_session(sta, tid, + WLAN_BACK_RECIPIENT); spin_unlock_bh(&sta->lock); - ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid, - WLAN_BACK_RECIPIENT); } } --- iwlwifi-2.6.orig/net/mac80211/ieee80211_i.h 2009-11-22 12:27:24.000000000 +0100 +++ iwlwifi-2.6/net/mac80211/ieee80211_i.h 2009-11-22 12:28:45.000000000 +0100 @@ -1057,6 +1057,8 @@ void ieee80211_process_addba_request(str int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, enum ieee80211_back_parties initiator); +int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + enum ieee80211_back_parties initiator); /* Spectrum management */ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata, Subject: mac80211: fix spurious delBA handling Lennert Buytenhek noticed that delBA handling in mac80211 was broken and has remotely triggerable problems, some of which are due to some code shuffling I did that ended up changing the order in which things were done -- this was commit d75636ef9c1af224f1097941879d5a8db7cd04e5 Author: Johannes Berg <johannes@sipsolutions.net> Date: Tue Feb 10 21:25:53 2009 +0100 mac80211: RX aggregation: clean up stop session and other parts were already present in the original commit d92684e66091c0f0101819619b315b4bb8b5bcc5 Author: Ron Rindjunsky <ron.rindjunsky@intel.com> Date: Mon Jan 28 14:07:22 2008 +0200 mac80211: A-MPDU Tx add delBA from recipient support The first problem is that I moved a BUG_ON before various checks -- thereby making it possible to hit. As the comment indicates, the BUG_ON can be removed since the ampdu_action callback must already exist when the state is != IDLE. The second problem isn't easily exploitable but there's a race condition due to unconditionally setting the state to OPERATIONAL when a delBA frame is received, even when no aggregation session was ever initiated. All the drivers accept stopping the session even then, but that opens a race window where crashes could happen before the driver accepts it. Right now, a WARN_ON may happen with non-HT drivers, while the race opens only for HT drivers. For this case, there are two things necessary to fix it: 1) don't process spurious delBA frames, and be more careful about the session state; don't drop the lock 2) HT drivers need to be prepared to handle a session stop even before the session was really started -- this is true for all drivers (that support aggregation) but iwlwifi which can be fixed easily. The other HT drivers (ath9k and ar9170) are behaving properly already. Reported-by: Lennert Buytenhek <buytenh@wantstofly.org> Cc: stable@kernel.org Signed-off-by: Johannes Berg <johannes@sipsolutions.net> --- Lennert reported the second problem a bit later, and I didn't initially want to report it to security@ but I've decided now that rolling up both fixes into one makes more sense because it's easier to handle and because very similar code paths are affected, triggered by the same frame type with slightly different settings. I have exploit code too, contact me if you need it to verify the problem. This patch is for wireless-testing only, a few functions have changed in the meantime. I'll follow up with a patch for 2.6.32, and can help with any other version that we need a patch for. I think we should begin making progress on these issues though -- some feedback would be appreciated! drivers/net/wireless/iwlwifi/iwl-tx.c | 10 +++++++++- include/net/mac80211.h | 6 ++++++ net/mac80211/agg-rx.c | 4 ---- net/mac80211/agg-tx.c | 15 +++++++-------- net/mac80211/ht.c | 8 +++----- net/mac80211/ieee80211_i.h | 2 ++ 6 files changed, 27 insertions(+), 18 deletions(-) --- iwlwifi-2.6.orig/drivers/net/wireless/iwlwifi/iwl-tx.c 2009-11-22 12:19:47.000000000 +0100 +++ iwlwifi-2.6/drivers/net/wireless/iwlwifi/iwl-tx.c 2009-11-22 12:23:41.000000000 +0100 @@ -1277,8 +1277,16 @@ int iwl_tx_agg_stop(struct iwl_priv *pri return -ENXIO; } + if (priv->stations[sta_id].tid[tid].agg.state == + IWL_EMPTYING_HW_QUEUE_ADDBA) { + IWL_DEBUG_HT(priv, "AGG stop before setup done\n"); + ieee80211_stop_tx_ba_cb_irqsafe(priv->hw, ra, tid); + priv->stations[sta_id].tid[tid].agg.state = IWL_AGG_OFF; + return 0; + } + if (priv->stations[sta_id].tid[tid].agg.state != IWL_AGG_ON) - IWL_WARN(priv, "Stopping AGG while state not IWL_AGG_ON\n"); + IWL_WARN(priv, "Stopping AGG while state not ON or starting\n"); tid_data = &priv->stations[sta_id].tid[tid]; ssn = (tid_data->seq_number & IEEE80211_SCTL_SEQ) >> 4; --- iwlwifi-2.6.orig/include/net/mac80211.h 2009-11-22 12:19:48.000000000 +0100 +++ iwlwifi-2.6/include/net/mac80211.h 2009-11-22 12:20:53.000000000 +0100 @@ -1283,6 +1283,12 @@ enum ieee80211_filter_flags { * * These flags are used with the ampdu_action() callback in * &struct ieee80211_ops to indicate which action is needed. + * + * Note that drivers MUST be able to deal with a TX aggregation + * session being stopped even before they OK'ed starting it by + * calling ieee80211_start_tx_ba_cb(_irqsafe), because the peer + * might receive the addBA frame and send a delBA right away! + * * @IEEE80211_AMPDU_RX_START: start Rx aggregation * @IEEE80211_AMPDU_RX_STOP: stop Rx aggregation * @IEEE80211_AMPDU_TX_START: start Tx aggregation --- iwlwifi-2.6.orig/net/mac80211/agg-rx.c 2009-06-02 22:49:53.000000000 +0200 +++ iwlwifi-2.6/net/mac80211/agg-rx.c 2009-11-22 12:20:53.000000000 +0100 @@ -85,10 +85,6 @@ void ieee80211_sta_stop_rx_ba_session(st struct ieee80211_local *local = sdata->local; struct sta_info *sta; - /* stop HW Rx aggregation. ampdu_action existence - * already verified in session init so we add the BUG_ON */ - BUG_ON(!local->ops->ampdu_action); - rcu_read_lock(); sta = sta_info_get(local, ra); --- iwlwifi-2.6.orig/net/mac80211/agg-tx.c 2009-11-17 18:26:13.000000000 +0100 +++ iwlwifi-2.6/net/mac80211/agg-tx.c 2009-11-22 12:20:53.000000000 +0100 @@ -123,13 +123,18 @@ void ieee80211_send_bar(struct ieee80211 ieee80211_tx_skb(sdata, skb, 0); } -static int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, - enum ieee80211_back_parties initiator) +int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + enum ieee80211_back_parties initiator) { struct ieee80211_local *local = sta->local; int ret; u8 *state; +#ifdef CONFIG_MAC80211_HT_DEBUG + printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n", + sta->sta.addr, tid); +#endif /* CONFIG_MAC80211_HT_DEBUG */ + state = &sta->ampdu_mlme.tid_state_tx[tid]; if (*state == HT_AGG_STATE_OPERATIONAL) @@ -143,7 +148,6 @@ static int ___ieee80211_stop_tx_ba_sessi /* HW shall not deny going back to legacy */ if (WARN_ON(ret)) { - *state = HT_AGG_STATE_OPERATIONAL; /* * We may have pending packets get stuck in this case... * Not bothering with a workaround for now. @@ -523,11 +527,6 @@ int __ieee80211_stop_tx_ba_session(struc goto unlock; } -#ifdef CONFIG_MAC80211_HT_DEBUG - printk(KERN_DEBUG "Tx BA session stop requested for %pM tid %u\n", - sta->sta.addr, tid); -#endif /* CONFIG_MAC80211_HT_DEBUG */ - ret = ___ieee80211_stop_tx_ba_session(sta, tid, initiator); unlock: --- iwlwifi-2.6.orig/net/mac80211/ht.c 2009-11-17 18:26:13.000000000 +0100 +++ iwlwifi-2.6/net/mac80211/ht.c 2009-11-22 12:22:56.000000000 +0100 @@ -141,7 +141,6 @@ void ieee80211_process_delba(struct ieee struct sta_info *sta, struct ieee80211_mgmt *mgmt, size_t len) { - struct ieee80211_local *local = sdata->local; u16 tid, params; u16 initiator; @@ -161,10 +160,9 @@ void ieee80211_process_delba(struct ieee WLAN_BACK_INITIATOR, 0); else { /* WLAN_BACK_RECIPIENT */ spin_lock_bh(&sta->lock); - sta->ampdu_mlme.tid_state_tx[tid] = - HT_AGG_STATE_OPERATIONAL; + if (sta->ampdu_mlme.tid_state_tx[tid] & HT_ADDBA_REQUESTED_MSK) + ___ieee80211_stop_tx_ba_session(sta, tid, + WLAN_BACK_RECIPIENT); spin_unlock_bh(&sta->lock); - ieee80211_stop_tx_ba_session(&local->hw, sta->sta.addr, tid, - WLAN_BACK_RECIPIENT); } } --- iwlwifi-2.6.orig/net/mac80211/ieee80211_i.h 2009-11-22 12:19:48.000000000 +0100 +++ iwlwifi-2.6/net/mac80211/ieee80211_i.h 2009-11-22 12:20:53.000000000 +0100 @@ -1083,6 +1083,8 @@ void ieee80211_process_addba_request(str int __ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, enum ieee80211_back_parties initiator); +int ___ieee80211_stop_tx_ba_session(struct sta_info *sta, u16 tid, + enum ieee80211_back_parties initiator); /* Spectrum management */ void ieee80211_process_measurement_req(struct ieee80211_sub_if_data *sdata, ----- End forwarded message -----
Created attachment 329373 [details] mac80211-spurious-2.6.32.patch
Created attachment 329374 [details] mac80211-spurious-2.6.31.6.patch
> The first problem is that I moved a BUG_ON before various > checks -- thereby making it possible to hit. As the comment > indicates, the BUG_ON can be removed since the ampdu_action > callback must already exist when the state is != IDLE. Please use CVE-2009-4026 for this problem. > The second problem isn't easily exploitable but there's a > race condition due to unconditionally setting the state to > OPERATIONAL when a delBA frame is received, even when no > aggregation session was ever initiated. All the drivers > accept stopping the session even then, but that opens a > race window where crashes could happen before the driver > accepts it. Right now, a WARN_ON may happen with non-HT > drivers, while the race opens only for HT drivers. And please use CVE-2009-4027 for the second one.
Committed to openSUSE-11.2 and master branch.
Just opened for tacking.
The SWAMPID for this issue is 29174. Please submit the patch and patchinfo file using this ID. (https://swamp.suse.de/webswamp/wf/29174)
[...] This is public now. Btw, there's another patch that was not reported to vendor-sec: http://git.kernel.org/linus/4253119acf412fd686ef4bd8749b5a4d70ea3a51. Take note. Eugene
jiri, i am afraid more work for you. but perhaps it comes via stable for 11.2 already
Part of the patch from comment 7 is already present in the patch in comment 0. The rest committed to openSUSE-11.2 and master branch (patches.fixes/mac80211-fix-remote-DoS.patch).
does this affect older kernels ? or when was it introduced? (customers will likely ask for a statement :/ )
It was introduced in 2.6.30. The oldest product affected is openSUSE 11.2.
Update released for: kernel-debug, kernel-debug-base, kernel-debug-base-debuginfo, kernel-debug-debuginfo, kernel-debug-debugsource, kernel-debug-devel, kernel-debug-devel-debuginfo, kernel-default, kernel-default-base, kernel-default-base-debuginfo, kernel-default-debuginfo, kernel-default-debugsource, kernel-default-devel, kernel-default-devel-debuginfo, kernel-desktop, kernel-desktop-base, kernel-desktop-base-debuginfo, kernel-desktop-debuginfo, kernel-desktop-debugsource, kernel-desktop-devel, kernel-desktop-devel-debuginfo, kernel-pae, kernel-pae-base, kernel-pae-base-debuginfo, kernel-pae-debuginfo, kernel-pae-debugsource, kernel-pae-devel, kernel-pae-devel-debuginfo, kernel-source, kernel-source-vanilla, kernel-syms, kernel-trace, kernel-trace-base, kernel-trace-base-debuginfo, kernel-trace-debuginfo, kernel-trace-debugsource, kernel-trace-devel, kernel-trace-devel-debuginfo, kernel-vanilla, kernel-vanilla-base, kernel-vanilla-base-debuginfo, kernel-vanilla-debuginfo, kernel-vanilla-debugsource, kernel-vanilla-devel, kernel-vanilla-devel-debuginfo, kernel-xen, kernel-xen-base, kernel-xen-base-debuginfo, kernel-xen-debuginfo, kernel-xen-debugsource, kernel-xen-devel, kernel-xen-devel-debuginfo, preload-kmp-default, preload-kmp-desktop Products: openSUSE 11.2 (debug, i586, x86_64)
CVE-2009-4026: CVSS v2 Base Score: 7.8 (important) (AV:N/AC:L/Au:N/C:N/I:N/A:C) CVE-2009-4026: Other (CWE-Other) CVE-2009-4027: CVSS v2 Base Score: 7.8 (important) (AV:N/AC:L/Au:N/C:N/I:N/A:C) CVE-2009-4027: Race Conditions (CWE-362)
hmm, nvd has: CVE-2009-4027: CVSS v2 Base Score: 7.1 (important) (AV:N/AC:M/Au:N/C:N/I:N/A:C)
fixed as we released 11.2 update