{"id":890,"date":"2021-04-12T23:54:43","date_gmt":"2021-04-12T21:54:43","guid":{"rendered":"http:\/\/blog.pi3.com.pl\/?p=890"},"modified":"2021-04-13T01:13:41","modified_gmt":"2021-04-12T23:13:41","slug":"lkrg-0-9-0-has-been-released","status":"publish","type":"post","link":"https:\/\/blog.pi3.com.pl\/?p=890","title":{"rendered":"LKRG 0.9.0 has been released!"},"content":{"rendered":"\n<p>During LKRG development and testing I&#8217;ve found 7 Linux kernel bugs, 4 of them have CVE numbers (however, 1 CVE number covers 2 bugs):<\/p>\n\n\n\n<!--more-->\n\n\n\n<pre class=\"wp-block-preformatted\"><a rel=\"noreferrer noopener\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-3411\" target=\"_blank\">CVE-2021-3411<\/a>  - Linux kernel: broken KRETPROBES and OPTIMIZER\n<a rel=\"noreferrer noopener\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-27825\" target=\"_blank\">CVE-2020-27825<\/a> - Linux kernel: Use-After-Free in the ftrace ring buffer\n                 resizing logic due to a race condition\n<a rel=\"noreferrer noopener\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-25220\" target=\"_blank\">CVE-2020-25220<\/a> - Linux kernel Use-After-Free in backported patch for\n                 CVE-2020-14356 (affected kernels: 4.9.x before 4.9.233,\n                 4.14.x before 4.14.194, and 4.19.x before 4.19.140)\n<a rel=\"noreferrer noopener\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-14356\" target=\"_blank\">CVE-2020-14356<\/a> - Linux kernel Use-After-Free in cgroup BPF component\n                 (affected kernels: since 4.5+ up to 5.7.10)<\/pre>\n\n\n\n<p>I&#8217;ve also found 2 other issues related to the ftrace UAF bug (<a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-27825\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2020-27825<\/a>):<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Deadlock issue which was not really addressed and devs said they will take a look and there is not much updates on that.<\/li><li>Problem with the code related to <em><strong>hwlatd <\/strong><\/em>kernel thread &#8211; it is incorrectly synchronizing with launcher \/ killer of it. You can have WARN in kernels all the time.<\/li><\/ul>\n\n\n\n<p><a href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2021-3411\" target=\"_blank\" rel=\"noreferrer noopener\">CVE-2021-3411<\/a> refers to 2 different type of bugs:<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Broken KRETPROBE (recently reported)<\/li><li>Incompatibility of KPROBE optimizer with the latest changes in the linker.<\/li><\/ul>\n\n\n\n<p>Additionally, I&#8217;ve also found a bug with the kernel signal handling in dying process:<\/p>\n\n\n\n<p><a rel=\"noreferrer noopener\" href=\"https:\/\/cve.mitre.org\/cgi-bin\/cvename.cgi?name=CVE-2020-12826\" target=\"_blank\">CVE-2020-12826<\/a> &#8211; Linux kernel prior to 5.6.5 does not sufficiently restrict exit signals<\/p>\n\n\n\n<p>However, I don&#8217;t remember if I found it during my work related to LKRG so I&#8217;m not counting it here (otherwise it would be total 8 bugs while 5 of them would have CVE).<\/p>\n\n\n\n<p>That&#8217;s pretty bad stats\u2026 However, it might be an interesting story to say during LKRG announcement of the new version. It could be also interesting talk for conference.<\/p>\n\n\n\n<p>Full announcement can be read here:<br><a rel=\"noreferrer noopener\" href=\"https:\/\/www.openwall.com\/lists\/announce\/2021\/04\/12\/1\" target=\"_blank\">https:\/\/www.openwall.com\/lists\/announce\/2021\/04\/12\/1<\/a><\/p>\n\n\n\n<p>Best regards,<br>Adam<\/p>\n","protected":false},"excerpt":{"rendered":"<p>During LKRG development and testing I&#8217;ve found 7 Linux kernel bugs, 4 of them have CVE numbers (however, 1 CVE number covers 2 bugs):<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[4,5,7],"tags":[],"class_list":["post-890","post","type-post","status-publish","format-standard","hentry","category-bughunt","category-exploiting","category-lkrg"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/890","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=890"}],"version-history":[{"count":3,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/890\/revisions"}],"predecessor-version":[{"id":893,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=\/wp\/v2\/posts\/890\/revisions\/893"}],"wp:attachment":[{"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=890"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=890"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.pi3.com.pl\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=890"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}