Add kernelCTF CVE-2024-46800_lts_cos_mitigation

[hexfoureight]

No description provided.

[artmetla]

Please add information on capabilities needed (if any?) to trigger the vulnerability. Do you use user namespaces?

[hexfoureight]

I've updated vulnerability.md to specify that user namespaces are needed.

[artmetla]

So before trigger_vuln is called, we have such a situation:

[Some DRR qdisc] → [DRR class "parent"] → [default/existing child qdisc]

Is this correct?

When we call void trigger_vuln (int parent), we replace the child qdisc, which makes (those are first 2 calls in function):

[DRR qdisc] → [DRR class "parent"] → [netem] → [drr] (empty, no classes)

and after that we add filter and class like this

[DRR qdisc] → [DRR class "parent"] → [netem] → [drr] → [drr class 1]
                                                          ↑
                                                  (filter with TC_ACT_STOLEN) 

Then we send packet with loopback_send(). And following happens:

1. Packet arrives, gets classified to parent class (due to outer filter set up before trigger_vuln)
2. parent is added to active list of its parent DRR qdisc
3. Packet travels: parent → netem → drr → drr class 1
4. TC_ACT_STOLEN action drops the packet
5. Bug: parent stays on active list even though packet was dropped

Finally, we call tc_del_qd(parent); which deletes the qdisc attached to "parent" (the netem). This deletes the netem qdisc (child of parent), which causes the parent class to be freed. And

[DRR qdisc] still has active_list pointing to → [FREED "parent" class]
                                                        ↑
                                                  USE-AFTER-FREE!

Is my logic correct? Could you add more information / explanations on how we actually trigger the vulnerability?

[hexfoureight]

Is my logic correct? Could you add more information / explanations on how we actually trigger the vulnerability?

It's all correct except for this part:

Finally, we call tc_del_qd(parent); which deletes the qdisc attached to "parent" (the netem). This deletes the netem qdisc (child of parent), which causes the parent class to be freed.

parent is not freed in trigger_vuln(), it is only put in a buggy state such that it will remain on the active list after being freed. The free happens when the class itself is deleted, here:

tc_del_cl(b1); // b1 freed
tbfp = b2 = drr_spray_and_find(b2);

and here:

tc_del_cl(b2); // b2 freed
b3 = drr_spray_and_find(b3);

I've updated the the docs to make this clearer.

I also noticed that the DRR qdisc does not actually need to have a class for the TC_ACT_STOLEN filter to work and updated trigger_vuln() to not create the class.

[artmetla]

Hello @hexfoureight

Thanks for submitting the exploit and writeup. Please, have a look at my comments and fix them.

[koczkatamas]

Hey! I've left a few comments on #261, I guess they apply to here as well, but let's discuss them there and when we finished there, let's apply the changes here as well.