Ubuntu
linux package

linux ADT test failure with linux/4.4.0-207.239 - ubuntu_qrt_kernel_security.test-kernel-security.py

Bug #1922200 reported by Kleber Sacilotto de Souza
18
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
Invalid
Undecided
Unassigned
Xenial
Fix Released
Medium
Kleber Sacilotto de Souza

Bug Description

[Impact]
The backport of upstream commit ad67b74d2469d9b82aaa572d76474c95bc484d57 ("printk: hash addresses printed with %p"), applied to fix CVEs CVE-2018-5953/CVE-2018-5995/CVE-2018-7754 on xenial/linux 4.4.0-207.239, introduced a regression caught by testcases from ubuntu_qrt_kernel_security.test-kernel-security.py testsuite.

The failing testcases are:
test_095_kernel_symbols_missing_kallsyms
test_095_kernel_symbols_missing_proc_modules
test_095_kernel_symbols_missing_proc_net_tcp
test_300_test_kaslr_base

The '095' testcases expect the addresses read by a regular user to be zeroed out and test '300' expects the default address for 'startup_64' to be 'ffffffff81000000' for non-kaslr kernels (<4.15). The applied backport leaks what the address 0x0 hashes to on the /proc interfaces instead of the expected values.

Examples:
$ head /proc/kallsyms
00000000b845aaf2 A irq_stack_union
00000000b845aaf2 A __per_cpu_start
00000000b845aaf2 A __per_cpu_user_mapped_start
00000000b845aaf2 A vector_irq
00000000b845aaf2 A unsafe_stack_register_backup
00000000b845aaf2 A cpu_debug_store
00000000b845aaf2 A cpu_tss
00000000b845aaf2 A exception_stacks
00000000b845aaf2 A gdt_page
00000000b845aaf2 A espfix_waddr

$ sudo head /proc/kallsyms
00000000b845aaf2 A irq_stack_union
00000000b845aaf2 A __per_cpu_start
00000000b845aaf2 A __per_cpu_user_mapped_start
00000000cd84b193 A vector_irq
00000000f271a77b A unsafe_stack_register_backup
00000000b451cc91 A cpu_debug_store
00000000108c2558 A cpu_tss
000000001484be48 A exception_stacks
000000000a1b6bc6 A gdt_page
00000000f38c128a A espfix_waddr

$ sudo grep -w startup_64 /proc/kallsyms
0000000028c44c50 T startup_64

[Fix]
For the backport to work as expected, we would likely need to backport the following commits as well:

57e734423add vsprintf: refactor %pK code out of pointer()
ef0010a30935 vsprintf: don't use 'restricted_pointer()' when not restricting

However, this could introduce other regressions as there are several corner cases in this code path.

Given that the CVEs which are fixed by this patch are all low or negligible, the best solution seems to be to revert this patch altogether.

[Test]
Run ubuntu_qrt_kernel_security.test-kernel-security.py tests from the kernel team autotest repository.

[Where problems could occur]
Reverting this patch can't introduce any regression as it would return the code to the previous state, however it would keep the kernel vulnerable to these CVEs.

[Additional Info]
Testing failed on:
    amd64: https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-xenial/xenial/amd64/l/linux/20210331_014541_79861@/log.gz
    i386: https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-xenial/xenial/i386/l/linux/20210331_012734_ec0bc@/log.gz
    ppc64el: https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-xenial/xenial/ppc64el/l/linux/20210331_014757_ec0bc@/log.gz
    s390x: https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-xenial/xenial/s390x/l/linux/20210330_031532_e87f8@/log.gz

See original description
Kleber Sacilotto de Souza (kleber-souza)
Changed in linux (Ubuntu):
status: New → Invalid
Changed in linux (Ubuntu Xenial):
status: New → Triaged
importance: Undecided → Medium
assignee: nobody → Kleber Sacilotto de Souza (kleber-souza)
Kleber Sacilotto de Souza (kleber-souza)
description: updated
summary: - linux/4.4.0-207.239 ADT test failure with linux/4.4.0-207.239
+ linux ADT test failure with linux/4.4.0-207.239 -
+ ubuntu_qrt_kernel_security.test-kernel-security.py
Kleber Sacilotto de Souza (kleber-souza)
Changed in linux (Ubuntu Xenial):
status: Triaged → In Progress
Kleber Sacilotto de Souza (kleber-souza)
Changed in linux (Ubuntu Xenial):
status: In Progress → Fix Committed
Kleber Sacilotto de Souza (kleber-souza)
tags: added: kernel-adt-failure
tags: added: xenial
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-xenial' to 'verification-done-xenial'. If the problem still exists, change the tag 'verification-needed-xenial' to 'verification-failed-xenial'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-xenial
Revision history for this message
Kleber Sacilotto de Souza (kleber-souza) wrote :

According to the autopkgtests logs:
https://objectstorage.prodstack4-5.canonical.com/v1/AUTH_77e2ada1e7a84929a74ba3b87153c0ac/autopkgtest-xenial/xenial/amd64/l/linux/20210405_165921_51e87@/log.gz

The following testcases are now passing as expected with xenial/linux 4.4.0-208.240:

test_095_kernel_symbols_missing_kallsyms
test_095_kernel_symbols_missing_proc_modules
test_095_kernel_symbols_missing_proc_net_tcp
test_300_test_kaslr_base

tags: added: verification-done-xenial
removed: verification-needed-xenial
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (20.3 KiB)

This bug was fixed in the package linux - 4.4.0-208.240

---------------
linux (4.4.0-208.240) xenial; urgency=medium

  * xenial/linux: 4.4.0-208.240 -proposed tracker (LP: #1922069)

  * linux ADT test failure with linux/4.4.0-207.239 -
    ubuntu_qrt_kernel_security.test-kernel-security.py (LP: #1922200) //
    CVE-2018-5953 // CVE-2018-5995 // CVE-2018-7754
    - SAUCE: Revert "printk: hash addresses printed with %p"

  * lxd 2.0.11-0ubuntu1~16.04.4 ADT test failure with linux 4.4.0-207.239
    (LP: #1921969)
    - SAUCE: Fix fuse regression in 4.4.0-207.239

linux (4.4.0-207.239) xenial; urgency=medium

  * xenial/linux: 4.4.0-207.239 -proposed tracker (LP: #1919558)

  * Xenial update: v4.4.262 upstream stable release (LP: #1920221)
    - uapi: nfnetlink_cthelper.h: fix userspace compilation error
    - ath9k: fix transmitting to stations in dynamic SMPS mode
    - net: Fix gro aggregation for udp encaps with zero csum
    - can: skb: can_skb_set_owner(): fix ref counting if socket was closed before
      setting skb ownership
    - can: flexcan: assert FRZ bit in flexcan_chip_freeze()
    - can: flexcan: enable RX FIFO after FRZ/HALT valid
    - netfilter: x_tables: gpf inside xt_find_revision()
    - cifs: return proper error code in statfs(2)
    - floppy: fix lock_fdc() signal handling
    - Revert "mm, slub: consider rest of partial list if acquire_slab() fails"
    - futex: Change locking rules
    - futex: Cure exit race
    - futex: fix dead code in attach_to_pi_owner()
    - net/mlx4_en: update moderation when config reset
    - net: lapbether: Remove netif_start_queue / netif_stop_queue
    - net: davicom: Fix regulator not turned off on failed probe
    - net: davicom: Fix regulator not turned off on driver removal
    - media: usbtv: Fix deadlock on suspend
    - mmc: mxs-mmc: Fix a resource leak in an error handling path in
      'mxs_mmc_probe()'
    - mmc: mediatek: fix race condition between msdc_request_timeout and irq
    - powerpc/perf: Record counter overflow always if SAMPLE_IP is unset
    - PCI: xgene-msi: Fix race in installing chained irq handler
    - s390/smp: __smp_rescan_cpus() - move cpumask away from stack
    - scsi: libiscsi: Fix iscsi_prep_scsi_cmd_pdu() error handling
    - ALSA: hda/hdmi: Cancel pending works before suspend
    - ALSA: hda: Avoid spurious unsol event handling during S3/S4
    - ALSA: usb-audio: Fix "cannot get freq eq" errors on Dell AE515 sound bar
    - s390/dasd: fix hanging DASD driver unbind
    - mmc: core: Fix partition switch time for eMMC
    - scripts/recordmcount.{c,pl}: support -ffunction-sections .text.* section
      names
    - Goodix Fingerprint device is not a modem
    - usb: gadget: f_uac2: always increase endpoint max_packet_size by one audio
      slot
    - usb: renesas_usbhs: Clear PIPECFG for re-enabling pipe with other EPNUM
    - xhci: Improve detection of device initiated wake signal.
    - USB: serial: io_edgeport: fix memory leak in edge_startup
    - USB: serial: ch341: add new Product ID
    - USB: serial: cp210x: add ID for Acuity Brands nLight Air Adapter
    - USB: serial: cp210x: add some more GE USB IDs
    - usbip: fix stub_dev to check for stream ...

Changed in linux (Ubuntu Xenial):
status: Fix Committed → Fix Released
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Duplicates of this bug

Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.