[LTP] [PATCH v4] fsconfig03: New test CVE-2022-0185

[Wei Gao]

On Fri, Feb 17, 2023 at 09:47:04AM +0100, Petr Vorel wrote:
> Hi all,
> 
> I've tested various kernels, it looks like test works as expected
> (older unpatched kernel fails, newer works, very old ones TCONF).
Thanks for great work!
> 
> > There are reproducers available for CVE-2022-0185
> > https://www.openwall.com/lists/oss-security/2022/01/25/14
> 
> > Also with links or even a zip file for an exploit
> > https://github.com/Crusaders-of-Rust/CVE-2022-0185
> 
> > The exploits are kind of complicated as they try to be complete,
> > but the exploitation vector is the fsconfig() syscall,
> > this case used for add some coverage to that to detect it.
> 
> > When kernel < v5.15.16, you can easily reproduce crash use test case
> > without check error and return logic in loop.
> 
> > I have used this test case trigger 5.14.1 kernel crash with ext2/4.
> 
> > Just make sure your kernel have not patched by following two commits:
> > e192ccc17ecf3 - fix up param length parsing in legacy_parse_param
> FYI: commit 722d94847de29310e8aa03fcbdb41fc92c521756 upstream.
> => that's a backport of 722d94847de29 we have in .tags in 5.15 stable branch.
> This is not obvious, because the hash is different; also hash will be
> different for for other kernel stable branches, e.g. in 5.10 stable it's
> backported into eadde287a62e66b2f9e62d007c59a8f50d4b8413.
> 
> This is misleading, I first wondered if e192ccc17ecf3 shouldn't be in tags
> (it shouldn't because it's a backport of 722d94847de29 => we don't put backports
> there: "We don’t track all backports to stable kernel but just those which are
> stable branch specific (unique), i.e. no commit in mainline. Example of commits:
> c4a23c852e80, cac68d12c531." [1]).
> 
> Therefore I'd remove this whole section ("Just make sure...").
> 

No problem for me.

> > cebe85d570cf8 - ext4: switch to the new mount api
> 
> I suppose test is now working as expected regardless kernel uses
> the old mount API or the new one (from cebe85d570cf8), right?
> Is this comment up to date?
This commit can impact test result in a very small window, in theory if you test kernel version 
between v5.15.16 ~ v5.17-rc1 for ext2/3/4, fsconfig will not give error until buffer size reach 
a page size. 
 
git describe --contains e192ccc17ecf3   //fix for legacy_parse_param
v5.15.16~24
git describe --contains cebe85d570cf8  //fix for switch new parse function
v5.17-rc1~131^2~36

> 
> Also, nit: kernel commits are usually put in form of hash ("..."), i.e.
> e192ccc17ecf ("vfs: fs_context: fix up param length parsing in legacy_parse_param")
> 
> Kind regards,
> Petr
> 
> [1] https://github.com/linux-test-project/ltp/wiki/C-Test-API#138-test-tags