[CBR 7.9] perf: Disallow mis-matched inherited group reads

[pvts-mat]

[CBR 7.9]
CVE-2023-5717
VULN-7623

Problem

https://www.cve.org/CVERecord?id=CVE-2023-5717

A heap out-of-bounds write vulnerability in the Linux kernel's Linux Kernel Performance Events (perf) component can be exploited to achieve local privilege escalation. If perf_read_group() is called while an event's sibling_list is smaller than its child's sibling_list, it can increment or write to memory locations outside of the allocated buffer.

Applicability: yes

The perf component is included with the CONFIG_PERF_EVENTS option, which is enabled in all ciqcbr7_9 configs

$ grep 'CONFIG_PERF_EVENTS\b' configs/*.config

configs/kernel-3.10.0-x86_64-debug.config:CONFIG_PERF_EVENTS=y
configs/kernel-3.10.0-x86_64.config:CONFIG_PERF_EVENTS=y

The commit "flipping the order of child_list and sibling_list" which introduced the bug - fa8c269 - was backported to ciqcbr7_9 in 170ca9a. The fixing commit 32671e3 is missing and wasn't backported.

Solution

The mainline fix 32671e3 adds a new group_generation field to the perf_event struct. This breaks CBR 7.9 kABI. The field was preserved, but moved to the end of the struct and wrapped in the RH_KABI_EXTEND macro. Unlike in the case of LTS 8.6 (#475) the investigation of whether it's safe to do was not necessary, because the struct already contained multiple RH_KABI_EXTEND(…) fields at the end, which could not have been added otherwise:

kernel-src-tree/include/linux/perf_event.h

Lines 586 to 615 in 10329e4

	RH_KABI_EXTEND(struct list_head migrate_entry)
	RH_KABI_EXTEND(struct list_head active_entry)
	RH_KABI_EXTEND(void *pmu_private)
	#if defined(CONFIG_FUNCTION_TRACER) && !defined(CONFIG_X86_64)
	RH_KABI_EXTEND(struct ftrace_ops ftrace_ops)
	#endif
	/* address range filters */
	RH_KABI_EXTEND(struct perf_addr_filters_head addr_filters)
	/* vma address array for file-based filders */
	RH_KABI_EXTEND(unsigned long *addr_filters_offs)
	RH_KABI_EXTEND(unsigned long addr_filters_gen)
	RH_KABI_EXTEND(struct list_head sb_list)
	RH_KABI_EXTEND(u64 (*clock)(void))
	/* The cumulative AND of all event_caps for events in this group. */
	RH_KABI_EXTEND(int group_caps)
	/*
	* Node on the pinned or flexible tree located at the event context;
	*/
	RH_KABI_EXTEND(struct rb_node group_node)
	RH_KABI_EXTEND(u64 group_index)
	RH_KABI_EXTEND(struct list_head active_list)
	#ifdef CONFIG_BPF_SYSCALL
	RH_KABI_EXTEND(perf_overflow_handler_t orig_overflow_handler)
	RH_KABI_EXTEND(struct bpf_prog *prog)
	#endif
	RH_KABI_EXTEND(unsigned long rcu_batches)
	RH_KABI_EXTEND(int rcu_pending)
	#endif /* CONFIG_PERF_EVENTS */
	};

Additionally, a fix-of-the-fix on the mainlie was commited in a71ef31 which was also included in this backport.

kABI check: passed

$ python /mnt/code/kernel-dist-git-el-7.9/SOURCES/check-kabi -k /mnt/code/kernel-dist-git-el-7.9/SOURCES/Module.kabi_x86_64 -s /mnt/build_files/kernel-src-tree-ciqcbr7_9-CVE-2023-5717/Module.symvers
$ echo $?
0

Boot test: passed

boot-test.log

Kselftests: passed relative

Reference

kselftests–ciqcbr7_9–run1.log
kselftests–ciqcbr7_9–run2.log
kselftests–ciqcbr7_9–run3.log

Patch

kselftests–ciqcbr7_9-CVE-2023-5717–run1.log
kselftests–ciqcbr7_9-CVE-2023-5717–run2.log
kselftests–ciqcbr7_9-CVE-2023-5717–run3.log

Comparison

The results were compared manually with Meld. No differences indicative of a problem introduced by the patch were found.

Specific tests: passed

While not strictly testing the provided patch, a very basic sanity check of the perf_events module was done to see if it remains functional.

Reference

$ uname -r 
3.10.0-ciqcbr7_9
$ sudo perf stat -B dd if=/dev/zero of=/dev/null count=1000000

1000000+0 records in
1000000+0 records out
512000000 bytes (512 MB) copied, 1.36361 s, 375 MB/s

 Performance counter stats for 'dd if=/dev/zero of=/dev/null count=1000000':

          1,366.22 msec task-clock                #    0.995 CPUs utilized          
                 3      context-switches          #    0.002 K/sec                  
                 0      cpu-migrations            #    0.000 K/sec                  
               217      page-faults               #    0.159 K/sec                  
     5,856,326,009      cycles                    #    4.287 GHz                    
     2,520,750,706      instructions              #    0.43  insn per cycle         
       544,415,208      branches                  #  398.483 M/sec                  
        11,042,875      branch-misses             #    2.03% of all branches        

       1.372717065 seconds time elapsed

       0.602402000 seconds user
       0.770071000 seconds sys

Patch

$ uname -r 
3.10.0-ciqcbr7_9-CVE-2023-5717
$ sudo perf stat -B dd if=/dev/zero of=/dev/null count=1000000

1000000+0 records in
1000000+0 records out
512000000 bytes (512 MB) copied, 1.39469 s, 367 MB/s

 Performance counter stats for 'dd if=/dev/zero of=/dev/null count=1000000':

          1,396.45 msec task-clock                #    0.995 CPUs utilized          
                 5      context-switches          #    0.004 K/sec                  
                 0      cpu-migrations            #    0.000 K/sec                  
               218      page-faults               #    0.156 K/sec                  
     5,900,275,843      cycles                    #    4.225 GHz                    
     2,520,173,133      instructions              #    0.43  insn per cycle         
       544,174,329      branches                  #  389.684 M/sec                  
        11,045,660      branch-misses             #    2.03% of all branches        

       1.404119544 seconds time elapsed

       0.669277000 seconds user
       0.734597000 seconds sys

[bmastbergen]

🥌

[thefossguy-ciq]

🚤