[LTS 8.6 RT] net: sched: sch_qfq: Fix UAF in qfq_dequeue()

[pvts-mat]

CVE-2023-4921
VULN-6729

Problem

https://www.cve.org/CVERecord?id=CVE-2023-4921

A use-after-free vulnerability in the Linux kernel's net/sched: sch_qfq component can be exploited to achieve local privilege escalation. When the plug qdisc is used as a class of the qfq qdisc, sending network packets triggers use-after-free in qfq_dequeue() due to the incorrect .peek handler of sch_plug and lack of error checking in agg_dequeue()

Solution

A single commit was identified as a fix for this issue: 8fc134fee27f2263988ae38920bc03da416b03d8

kABI check: omitted (unstable ABI of RT kernels)

Boot test: passed

See Specific tests for implied boot test passing.

Kselftests: passed relative

Methodology

Source-compiled (e1a9851e6068a6ef800ec6b2b48a7c243882ed06) kselftests suite was used.

Coverage (including tests skipped during execution)

android, breakpoints, capabilities, core, cpu-hotplug, cpufreq, efivarfs, exec, filesystems, firmware, fpu, ftrace, futex, gpio, intel_pstate, ipc, kcmp, kvm, lib, livepatch, membarrier, memfd, memory-hotplug, mount, net, net/forwarding, net/mptcp, netfilter, nsfs, proc, pstore, ptrace, rseq, rtc, sgx, sigaltstack, size, splice, static_keys, sync, sysctl, tc-testing, timens, timers, tpm2, user, vm, x86, zram

Reference ciqlts8_6-rt (e71882f570f197b48b8bc1083d12926abbbac9c1)

Three test runs were conducted on the reference kernel.
kselftests–src–ciqlts8_6-rt–run1.log
kselftests–src–ciqlts8_6-rt–run2.log
kselftests–src–ciqlts8_6-rt–run3.log

Patch

Two test runs were conducted on the patched kernel.
kselftests–src–ciqlts8_6-rt-CVE-2023-4921–run1.log
kselftests–src–ciqlts8_6-rt-CVE-2023-4921–run2.log

Comparison

Overview of the results, reduced to the differences:

ktests.xsh table --where "Summary = 'diff'" kselftests--*.log

Column    File
--------  -----------------------------------------------------
Status0   kselftests--src--ciqlts8_6-rt--run1.log
Status1   kselftests--src--ciqlts8_6-rt--run2.log
Status2   kselftests--src--ciqlts8_6-rt--run3.log
Status3   kselftests--src--ciqlts8_6-rt-CVE-2023-4921--run1.log
Status4   kselftests--src--ciqlts8_6-rt-CVE-2023-4921--run2.log

TestCase                   Status0  Status1  Status2  Status3  Status4  Summary
kvm:hardware_disable_test  fail     fail     pass     pass     pass     diff
net/mptcp:mptcp_join.sh    fail     fail     pass     fail     pass     diff
net:gro.sh                 fail     fail     fail     fail     pass     diff

Tests kvm:hardware_disable_test, net/mptcp:mptcp_join.sh show inconsistent behavior within the reference kernel testing itself. The net:gro.sh test was known to give inconsistent results before, like for many other Rocky versions, even if it consistently failed in this testing batch.

Additionally, the netfilter:nft_trans_stress.sh test was identified to be problematic: it may hang the machine, potentially indefinitely. It was interrupted after 10 minutes and was responsible for reduced scope of kselftests--src--ciqlts8_6-rt--run3.log test.

Specific tests: passed

Bug replication

The bug can be replicated with the following commands, as mention in the commit's message:

tc qdisc add dev lo root handle 1: qfq
tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
tc qdisc add dev lo parent 1:1 handle 2: plug
tc filter add dev lo parent 1: basic classid 1:1
ping -c1 127.0.0.1

The tests were performed on the referential and patched kernel.

Prerequisites

The tc commands above require the following kernel options to be enabled: CONFIG_NET_SCHED, CONFIG_NET_SCH_INGRESS, CONFIG_NET_SCH_QFQ, CONFIG_NET_SCH_PLUG, CONFIG_NET_CLS_BASIC.

All of them are enabled by default in the configs/kernel-rt-4.18.0-x86_64.config configuration file for the tested x86_64 platform.

CONFIG_NET_SCHED=y
CONFIG_NET_SCH_INGRESS=m
CONFIG_NET_SCH_QFQ=m
CONFIG_NET_SCH_PLUG=m
CONFIG_NET_CLS_BASIC=m

Reference ciqlts8_6-rt (e71882f570f197b48b8bc1083d12926abbbac9c1)

Bug replicated successfully. Kernel crashed and machine automatically rebooted, although no crash report was observed as in the non-RT LTS 8.6 version.

[root@ciqlts8_6-rt pvts]# tc qdisc add dev lo root handle 1: qfq
tc qdisc add dev lo root handle 1: qfq
bash: tc: command not found
...
[root@ciqlts8_6-rt pvts]# sudo dnf --color=never install iproute-tc -y 
...
[root@ciqlts8_6-rt pvts]# tc qdisc add dev lo root handle 1: qfq
tc qdisc add dev lo root handle 1: qfq
[root@ciqlts8_6-rt pvts]# tc class add dev lo parent 1: classid 1:1 qfq weight 1 maxpkt 512
 maxpkt 512
[root@ciqlts8_6-rt pvts]# tc qdisc add dev lo parent 1:1 handle 2: plug
tc qdisc add dev lo parent 1:1 handle 2: plug
[root@ciqlts8_6-rt pvts]# tc filter add dev lo parent 1: basic classid 1:1
tc filter add dev lo parent 1: basic classid 1:1
[root@ciqlts8_6-rt pvts]# ping -c1 127.0.0.1
ping -c1 127.0.0.1
PING 127.0.0.1 (127.0.0.1) 56(84) bytes of data.
[    0.000000] Linux version 4.18.0-ciqlts8_6-rt (pvts@ciqlts8_6-rt) (gcc version 8.5.0 20210514 (Red Hat 8.5.0-10) (GCC)) #2 SMP PREEMPT_RT Thu Feb 6 03:59:29 UTC 2025
[    0.000000] Command line: elfcorehdr=0x73000000 BOOT_IMAGE=(hd0,msdos1)/boot/vmlinuz-4.18.0-ciqlts8_6-rt ro console=ttyS0,115200n8 no_timer_check net.ifnames=0 irqpoll nr_cpus=1 reset_devices cgroup_disable=memory mce=off numa=off udev.children-max=2 panic=10 rootflags=nofail acpi_no_memhotplug transparent_hugepage=never nokaslr novmcoredd hest_disable disable_cpu_apicid=0 iTCO_wdt.pretimeout=0
...

Full log:
bug-replication–ciqlts8_6-rt.log

Patch

Patch efficacy verified successfully. Repeating the steps doesn't result in a crash and the machine doesn't reboot.

Full log:
bug-replication–ciqlts8_6-rt-CVE-2023-4921.log

A warning can be observed

qfq_dequeue: non-workconserving leaf

issued at sch_qfq.c. The work-conserving queue discipline is a qdisc which never leaves the outbound interface in idle unless the queue is empty, while non-work-conserving qdiscs may delay packets, for example to shape the traffic¹. The plug qdisc, being the leaf in the hierarchical qdiscs configuration used, is non-work-conserving, as it is able to suspend the packet flow. Multiple types of qdiscs are apparently not designed to work with non-work-conserving child qdiscs and issue similar warnings on skb == NULL condition: ets, hfsc, htb, drr. See also the message in b00355db3f88d96810a60011a30cfb2c3469409d

Patrick McHardy <[email protected]> suggested:
> How about making this flag and the warning message (in a out-of-line
> function) globally available? Other qdiscs (f.i. HFSC) can't deal with
> inner non-work-conserving qdiscs as well.

and in 6d25d1dc76bf5943a5c1f4bb74d66d5eac58eb77, which includes qfq to the group above

A helper function for printing non-work-conserving alarms is added in
commit b00355db3f88 ("pkt_sched: sch_hfsc: sch_htb: Add non-work-conserving
 warning handler."). In this commit, use qdisc_warn_nonwc() instead of
WARN_ONCE() to handle the non-work-conserving warning in qfq Qdisc.

The point is: the warning is related to the way the qdisc hierarchy has been defined in the bug replication script and not to the introduced changes.

Footnotes

¹ https://tldp.org/HOWTO/Adv-Routing-HOWTO/lartc.qdisc.terminology.html

[PlaidCat]

Starting github runners too

EDIT: I didn't notice this was in draft ahead of time.

[pvts-mat]

EDIT: I didn't notice this was in draft ahead of time.

Need to add the selftests, they're on the way

[gvrose8192]

In line with previous commits in the CVE series