Linux Kernel BPF Sysctl Write Buffer Memory Corruption Vulnerability

A vulnerability in the Linux kernel's handling of sysctl write buffers can lead to memory corruption. The issue arises in the BPF (Berkeley Packet Filter) subsystem, where the 'proc_sys_call_handler' function allocates a temporary sysctl buffer using 'kvzalloc'. This buffer is then passed to '__cgroup_bpf_run_filter_sysctl'. However, 'kvzalloc' may revert to 'vmalloc' for large allocations, making it inappropriate to free the buffer with 'kfree', as this can cause memory corruption. The correct approach is to use 'kvfree', which safely manages both 'kmalloc' and 'kvzalloc'/'vmalloc' allocations. This vulnerability was initially detected by an experimental analysis tool designed to identify kernel memory management issues, during a review of version 6.13-rc1. Although the tool is still being developed and is not yet available to the public, a manual inspection has verified that the vulnerability persists in version 7.1-rc5.

Impact

Exploitation of this vulnerability can lead to memory corruption, causing a page fault error. The fault occurs when the kernel attempts to read from a non-existent page, which can disrupt normal system operations and potentially be exploited to cause further harm.

Reproduction

The vulnerability can be reproduced in a QEMU x86_64 guest environment running Linux 7.1-rc4, with KASAN (Kernel Address Sanitizer) and CONFIG_FAILSLAB enabled. The reproduction process involves writing 8191 bytes to '/proc/sys/kernel/domainname' from a task in the target cgroup. This action triggers a fault due to the improper handling of the sysctl buffer, leading to a page fault error.

Remediation

Users can update to the latest version of the Linux kernel, where this vulnerability has been fixed. Instructions for updating the kernel can be found in the official Linux kernel documentation.