Linux Kernel FunctionFS DMABUF Request Handling Vulnerability Leading to Use-After-Free

A use-after-free vulnerability has been identified in the Linux kernel's USB gadget FunctionFS implementation, specifically within the DMABUF handling. The issue arises because the function 'ffs_epfile_dmabuf_io_complete' frees a USB request but leaves a pointer to the freed memory, creating a race condition. This freed pointer can be accessed later, leading to undefined behavior. The vulnerability was reproduced under the Kernel Address Sanitizer (KASAN) on both detach and close paths, indicating that the issue can be triggered during normal operation of the FunctionFS DMABUF interface.

Impact

Exploitation of this vulnerability causes a use-after-free condition, where a pointer to a freed USB request is accessed, potentially leading to memory corruption or arbitrary code execution.

Reproduction

The vulnerability can be reproduced by using the FunctionFS DMABUF interface while the Kernel Address Sanitizer (KASAN) is enabled. Attach an observability hook to check the status of the 'priv->req' pointer before it is dequeued, which will reveal the use-after-free condition. This can be done by sending a 'FUNCTIONFS_DMABUF_DETACH' ioctl or by closing the FunctionFS epfile, both of which will trigger the vulnerability by accessing the freed memory.

Remediation

Users should upgrade to the latest stable version of the Linux kernel, where this vulnerability has been fixed. Instructions for downloading the latest version can be found on the official Linux kernel website.