Original URL: https://hkpco.kr/advisory/CVE-2013-1059.txt

< Linux Kernel libceph Null Pointer Dereference Vulnerability
(CVE-2013-1059) >


Author   - Chanam Park (@hkpco)
Website - https://hkpco.kr/
Date      - 2013. 07. 06



0. Introduction

This is very brief advisory just to record the vulnerability which I
discovered in my spare time.
A remote attacker, malicious ceph monitor, can make an exploit to cause a
denial-of-service condition by sending the crafted auth_reply message.
It could possibly lead to another impacts such as remote code execution if
some other vulnerabilities are combined.
An explanation is based on linux kernel 3.10 which is latest version now.



1. What's Ceph?

Check these links below.

https://en.wikipedia.org/wiki/Ceph_(storage)
https://ceph.com/



2. Vulnerability

The vulnerability is triggered by a null pointer dereferencing problem
which can raise a kernel crash remotely.

Here, I will show you the code flow about vulnerability.

Let's start with the dispatch() function which handles incoming auth
message from the ceph monitor.

https://lxr.linux.no/linux+v3.10/net/ceph/mon_client.c
-------
 963 static void dispatch(struct ceph_connection *con, struct ceph_msg *msg)
 964 {
 965        struct ceph_mon_client *monc = con->private;
 966        int type = le16_to_cpu(msg->hdr.type);
 967
 968        if (!monc)
 969                return;
 970
 971        switch (type) {
 972        case CEPH_MSG_AUTH_REPLY:
 973                handle_auth_reply(monc, msg); *** [1] ***
 974                break;
...
-------

As shown in part [1], It calls handle_auth_reply() once ceph client
receives the auth reply message from monitor.

See handle_auth_reply() implementation in the same module, then.

-------
 886 static void handle_auth_reply(struct ceph_mon_client *monc,
 887                              struct ceph_msg *msg)
 888 {
 889        int ret;
 890        int was_auth = 0;
 891        int had_debugfs_info, init_debugfs = 0;
 892
 893        mutex_lock(&monc->mutex);
 894        had_debugfs_info = have_debugfs_info(monc);
 895        was_auth = ceph_auth_is_authenticated(monc->auth);
 896        monc->pending_auth = 0;
 897        ret = ceph_handle_auth_reply(monc->auth, msg->front.iov_base, ***
[2] ***
 898                                     msg->front.iov_len,
 899                                     monc->m_auth->front.iov_base,
 900                                     monc->m_auth->front_max);
...
-------

At in part [2], It calls ceph_handle_auth_reply().

Move to take a look at the function.

https://lxr.linux.no/linux+v3.10/net/ceph/auth.c
-------
 174 int ceph_handle_auth_reply(struct ceph_auth_client *ac,
 175                           void *buf, size_t len,
 176                           void *reply_buf, size_t reply_len)
 177 {
 178        void *p = buf;
 179        void *end = buf + len;
 180        int protocol;
...
 239        ret = ac->ops->handle_reply(ac, result, payload, payload_end);
 240        if (ret == -EAGAIN) {
 241                ret = ceph_build_auth_request(ac, reply_buf,
reply_len); ***
[3] ***
 242        } else if (ret) {
 243                pr_err("auth method '%s' error %d\n", ac->ops->name,
ret);
 244        }
-------

As you can see in the part [3] above, ceph_build_auth_request() contains a
vulnerable code to cause the null pointer dereference.

Let's see how the function implements a vulnerable code below.

https://lxr.linux.no/linux+v3.10/net/ceph/auth.c
-------
 144 static int ceph_build_auth_request(struct ceph_auth_client *ac,
 145                                   void *msg_buf, size_t msg_len)
 146 {
 147        struct ceph_mon_request_header *monhdr = msg_buf;
 148        void *p = monhdr + 1;
 149        void *end = msg_buf + msg_len;
 150        int ret;
 151
 152        monhdr->have_version = 0;
 153        monhdr->session_mon = cpu_to_le16(-1);
 154        monhdr->session_mon_tid = 0;
 155
 156        ceph_encode_32(&p, ac->protocol);
 157
 158        ret = ac->ops->build_request(ac, p + sizeof(u32), end); *** [3]
***
 159        if (ret < 0) {
 160                pr_err("error %d building auth method %s request\n",
ret,
 161                       ac->ops->name);
 162                goto out;
 163        }
 164        dout(" built request %d bytes\n", ret);
 165        ceph_encode_32(&p, ret);
 166        ret = p + ret - msg_buf;
 167 out:
 168        return ret;
 169 }
-------

The code above, at part [3], calls a function pointer from ceph_auth_client
structure without any value checking whether it's null or something else.

Moreover, you can see in the next part soon, some function pointers in the
structure hasn't been defined at all.

Here's the problematic structure prototypes below.

https://lxr.linux.no/linux+v3.9.6/include/linux/ceph/auth.h
-------
...
  25 struct ceph_auth_client_ops {
  26        const char *name;
  27
...
  40        /*
  41         * build requests and process replies during monitor
  42         * handshake.  if handle_reply returns -EAGAIN, we build
  43         * another request.
  44         */
  45        int (*build_request)(struct ceph_auth_client *ac, void *buf,
void *end); *** [4] ***
...
  71 struct ceph_auth_client {
  72        u32 protocol;           /* CEPH_AUTH_* */
  73        void *private;          /* for use by protocol implementation */
  74        const struct ceph_auth_client_ops *ops;  /* null iff
protocol==0 */ *** [5] ***
...
-------

At part [4], ceph_auth_client_ops structure has a build_request() as a
member variable.

At part [5], ceph_auth_client_ops is defined within ceph_auth_client
structure.

If we confirm that the ceph_auth_client_ops structure does not initialize
the build_request() function pointer, and that's being used as it is,

the null pointer dereference can easily occur.

Let's see.

https://lxr.linux.no/linux+v3.10/net/ceph/auth_none.c
-------
 103 static const struct ceph_auth_client_ops ceph_auth_none_ops = {
 104        .name = "none",
 105        .reset = reset,
 106        .destroy = destroy,
 107        .is_authenticated = is_authenticated,
 108        .should_authenticate = should_authenticate,
 109        .handle_reply = handle_reply,
 110        .create_authorizer = ceph_auth_none_create_authorizer,
 111        .destroy_authorizer = ceph_auth_none_destroy_authorizer,
 112 };
 113
 114 int ceph_auth_none_init(struct ceph_auth_client *ac)
 115 {
 116        struct ceph_auth_none_info *xi;
 117
 118        dout("ceph_auth_none_init %p\n", ac);
 119        xi = kzalloc(sizeof(*xi), GFP_NOFS);
 120        if (!xi)
 121                return -ENOMEM;
 122
 123        xi->starting = true;
 124        xi->built_authorizer = false;
 125
 126        ac->protocol = CEPH_AUTH_NONE;
 127        ac->private = xi;
 128        ac->ops = &ceph_auth_none_ops; *** [6] ***
 129        return 0;
 130 }
-------

As shown in the part [6] above, ceph_auth_none_ops structure is being used
as a ceph operation with no build_request definition.

Boom!,



3. Patch

Tyler Hicks made a fix for it.
https://git.kernel.org/cgit/linux/kernel/git/sage/ceph-client.git/commit/?id=2cb33cac622afde897aa02d3dcd9fbba8bae839e



4. Credit

Chanam Park discovered this bug.
https://seclists.org/oss-sec/2013/q3/61



5. References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1059
https://www.cvedetails.com/cve/CVE-2013-1059/
https://www.openwall.com/lists/oss-security/2013/07/09/7
https://bugzilla.redhat.com/show_bug.cgi?id=977356
https://ceph.com/git/?p=ceph-client.git;a=commit;h=2cb33cac622afde897aa02d3dcd9fbba8bae839e