From nobody Thu Aug 18 16:15:51 2022 X-Original-To: freebsd-hackers@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4M7qkN0QhJz4Zs3Z for ; Thu, 18 Aug 2022 16:15:56 +0000 (UTC) (envelope-from markjdb@gmail.com) Received: from mail-qk1-x72a.google.com (mail-qk1-x72a.google.com [IPv6:2607:f8b0:4864:20::72a]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (2048 bits) client-digest SHA256) (Client CN "smtp.gmail.com", Issuer "GTS CA 1D4" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4M7qkM2c7lz49YC for ; Thu, 18 Aug 2022 16:15:55 +0000 (UTC) (envelope-from markjdb@gmail.com) Received: by mail-qk1-x72a.google.com with SMTP id n21so1470242qkk.3 for ; Thu, 18 Aug 2022 09:15:55 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:sender:from:to:cc; bh=Omp1OXW5DKN5HZ8a5KDXm+QOw+P048r3r2DUjduiYfE=; b=hE0zHaApG35nFZl1hTHCUZt40DDuOJh/yd6ug2iUx7IEPR78zyjkXSa1C3Az4AeoyG 2R+J3WWCldPmtk1bOxsr4GOC5EaNqeM3OgUgTlIHkQhTBJwEz3dTZ/k7qq4bHiBvLjgp DfSNq8sEIkuoP0DXNuJP0fOlE8f4qKtCnVWpi8nuP2Alg7mfTA1/6g06Ke+OL55Qm6P5 bP/sJTWZzJB8L0IuZfwrSNMhSVdGuVd68AqM2d1pQ+2UNX06QVqKNYah4NER1AUIYuk5 UMGzwH155dhes4QjsVz5tbxb6sveloyTrT48AMepx6aKug3yJ9mPf2pruuNfmSBwoXyX xBRA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:sender:x-gm-message-state:from:to:cc; bh=Omp1OXW5DKN5HZ8a5KDXm+QOw+P048r3r2DUjduiYfE=; b=I+j8RrWeiGGUVmnVVgiQDPb4q6dY3yl+EhtrGUqKwKIsRJp5/X4kfRrJwG83cRwiJV qffgHxQbCAgcyOg0b3z3Gbo9WKSVs3s0bxRPeecfadUdGMiGEgT5RHYYF4wPp8ywsS8p qErIP49yU6DmgmHHPaD0vRZR3wAZsDBH4bMRSH2AUifUFLuh4hq1dTv7lQ+nAqkLVJiL 2YM0UD2kEbI72HO6W1G77/7JFXslxFpH+ntK2w7kggVx6l5LBZNwraoT2lvwSyuStqx6 rvzIcVIKomPopFnyVViZ4vKUrhcreN9T1vmGINs4xjeJFcC61yI+ZBFOaZZpfs/qc6Mv YiJg== X-Gm-Message-State: ACgBeo0cm7x3Ff4ZKB5cwjyFLxbz0fbOeEcPD6S0ZpD8wHI/PJt7/w+L pqgWRyvlI/in9kIro/rFf7ZGkF47EaY= X-Google-Smtp-Source: AA6agR6A1+DRPrIn6xoPVVyOnVlXHSo4w8ZF1srvMuSm9lWETfIibOB7Jg0KgQz0wdKo/OJapCdFvA== X-Received: by 2002:a05:620a:1402:b0:6bb:6c8a:e590 with SMTP id d2-20020a05620a140200b006bb6c8ae590mr2594354qkj.598.1660839354440; Thu, 18 Aug 2022 09:15:54 -0700 (PDT) Received: from nuc (192-0-220-237.cpe.teksavvy.com. [192.0.220.237]) by smtp.gmail.com with ESMTPSA id z15-20020a05622a060f00b0034308283775sm1316706qta.21.2022.08.18.09.15.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 18 Aug 2022 09:15:53 -0700 (PDT) Date: Thu, 18 Aug 2022 12:15:51 -0400 From: Mark Johnston To: Eric van Gyzen Cc: freebsd-hackers Subject: Re: Impact of FreeBSD-SA-22:10.aio Message-ID: References: List-Id: Technical discussions relating to FreeBSD List-Archive: https://lists.freebsd.org/archives/freebsd-hackers List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-freebsd-hackers@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: X-Rspamd-Queue-Id: 4M7qkM2c7lz49YC X-Spamd-Bar: -- Authentication-Results: mx1.freebsd.org; dkim=pass header.d=gmail.com header.s=20210112 header.b=hE0zHaAp; dmarc=none; spf=pass (mx1.freebsd.org: domain of markjdb@gmail.com designates 2607:f8b0:4864:20::72a as permitted sender) smtp.mailfrom=markjdb@gmail.com X-Spamd-Result: default: False [-2.69 / 15.00]; NEURAL_HAM_LONG(-1.00)[-0.999]; NEURAL_HAM_SHORT(-1.00)[-0.999]; NEURAL_HAM_MEDIUM(-0.99)[-0.993]; MID_RHS_NOT_FQDN(0.50)[]; FORGED_SENDER(0.30)[markj@freebsd.org,markjdb@gmail.com]; R_DKIM_ALLOW(-0.20)[gmail.com:s=20210112]; R_SPF_ALLOW(-0.20)[+ip6:2607:f8b0:4000::/36:c]; MIME_GOOD(-0.10)[text/plain]; FROM_HAS_DN(0.00)[]; MLMMJ_DEST(0.00)[freebsd-hackers@freebsd.org]; DMARC_NA(0.00)[freebsd.org]; PREVIOUSLY_DELIVERED(0.00)[freebsd-hackers@freebsd.org]; TO_MATCH_ENVRCPT_SOME(0.00)[]; RCVD_IN_DNSWL_NONE(0.00)[2607:f8b0:4864:20::72a:from]; RCVD_VIA_SMTP_AUTH(0.00)[]; DWL_DNSWL_NONE(0.00)[gmail.com:dkim]; FROM_NEQ_ENVFROM(0.00)[markj@freebsd.org,markjdb@gmail.com]; DKIM_TRACE(0.00)[gmail.com:+]; TO_DN_ALL(0.00)[]; RCVD_COUNT_THREE(0.00)[3]; ARC_NA(0.00)[]; RCPT_COUNT_TWO(0.00)[2]; FREEMAIL_ENVFROM(0.00)[gmail.com]; MIME_TRACE(0.00)[0:+]; ASN(0.00)[asn:15169, ipnet:2607:f8b0::/32, country:US]; RCVD_TLS_LAST(0.00)[] X-ThisMailContainsUnwantedMimeParts: N On Thu, Aug 18, 2022 at 11:08:47AM -0500, Eric van Gyzen wrote: > The Impact section of FreeBSD-SA-22:10.aio says > > An attacker may cause the reference count to overflow, > leading to a use after free (UAF). > > I don't see how the refcount can overflow. That seems to be prevented > by REFCOUNT_SATURATED and friends. Does anyone care to enlighten me? > There is the small window between fetchadd and detecting saturation; is > this the [only] way? The refcount implementation in 12.3 doesn't handle overflow or underflow at all, so it is vulnerable. I believe you're right that that mitigation converts the bug into a memory leak in 13.0, and so the advisory erroneously lists 13.0 as vulnerable when it isn't.