CVE-2024-39292 - Linux Kernel Vulnerability: um: Add winch to winch_handlers before registering winch IRQ

A recently discovered Linux kernel vulnerability, identified as CVE-2024-39292, is related to the improper initialization and handling of winch IRQ handlers in the User Mode Linux (UML) subsystem. This flaw can lead to memory corruption, cause the kernel to panic, as well as other undefined behaviors. In this blog post, we will delve into the details of this vulnerability, illustrate a code snippet that addresses the problem, and provide links to the original references.

Vulnerability Details

The vulnerability resides in the initialization of winch_handlers in the UML subsystem. When registering a winch IRQ, a potential race condition exists, which could trigger an interrupt before adding the winch object to the winch_handlers list. As a result, the register_winch_irq() function might add a winch object that is marked to be freed or has already been freed to the list, causing a kernel panic when the winch_cleanup() function is called later.

To fix this vulnerability, the winch object should be added to the winch_handlers list before registering the IRQ and rolled back if the um_request_irq() function fails. This eliminates the race condition present in the initial implementation and avoids the memory corruption issue.

Code Snippet

The following code snippet demonstrates how to correctly handle the initialization and handling of winch IRQ handlers:

/*...*/
spin_lock(&winch_lock);
list_add(&winch->list, &winch_handlers);
spin_unlock(&winch_lock);

/* Register winch IRQ */
err = um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
                     SA_INTERRUPT | SA_SHIRQ, "winch", winch);
if (err) {
    spin_lock(&winch_lock);
    list_del(&winch->list);
    spin_unlock(&winch_lock);
    printk(KERN_ERR "register_winch_irq - failed to register IRQ, "
                    "errno = %d\n", -err);
    return;
}
/*...*/

Original References

The original patch and discussion for this vulnerability can be found in the Linux kernel mailing list archive:

1. Patch: Linux kernel source repository commit
2. Discussion: Linux kernel mailing list archive

Conclusion

CVE-2024-39292 is an important vulnerability in the Linux kernel's User Mode Linux subsystem. Properly initializing and handling winch IRQ handlers eliminates the potential for memory corruption and other issues resulting from this flaw. Following best practices and keeping your system up-to-date with the latest patches will help ensure the security and stability of your Linux environment.

Timeline

Published on: 06/24/2024 14:15:12 UTC
Last modified on: 06/27/2024 12:15:29 UTC