[CVE request]linux kernel xfrm migrate out-of-bound access

Issue description:

xfrm migrate is a mechanism of kernel ipsec xfrm framework.

When dealing with XFRM_MSG_MIGRATE message, xfrm_migrate func does not
 check dir value of xfrm_userpolicy_id.
This will cause out of bound access to net->xfrm.policy_bydst in
policy_hash_direct func and others when dir value exceeds
XFRM_POLICY_MAX.

The whole value of struct xfrm_userpolicy_id can be controlled by
sending netlink message, and the out of bound addr can be expected;
this may lead to potential security issue.


Affected version: linux kernel 4.12 and lower



PoC: send a crafted xfrm netlink message with type XFRM_MSG_MIGRATE


Kernel panic: this issue tiggered a kernel panic


Unable to handle kernel paging request at virtual address 04821020
pgd = ffffffc05d9ce000
[04821020] *pgd=000000009b82a003, *pud=000000009b82a003, *pmd=0000000000000000
Internal error: Oops: 96000006 [#1] PREEMPT SMP
Modules linked in:

task: ffffffc05d953100 ti: ffffffc05b82c000 task.ti: ffffffc05b82c000
PC is at xfrm_migrate+0x208/0x80c
LR is at xfrm_migrate+0x208/0x80c
pc : [<ffffffc0005f0c4c>] lr : [<ffffffc0005f0c4c>] pstate: 00000145
sp : ffffffc05b82f560
x29: ffffffc05b82f560 x28: 000000000000000a
x27: 0000000000000001 x26: ffffffc05d884298
x25: 000000000000001a x24: ffffffc000905ac4
x23: ffffffc05b82f6d8 x22: 0000000000000001
x21: ffffffc000904c40 x20: ffffffc05b82f6d8
x19: 0000000000000001 x18: 0000000000000000
x17: 0000000000000001 x16: ffffffc0004e1bf4
x15: 0000000000000000 x14: 6e202c3731203a29
x13: 657079745f67736d x12: 6c6e286570797420
x11: 2c67736d5f766365 x10: 725f726573755f6d
x9 : 726678202c677562 x8 : 64202c6b6f206573
x7 : 7261705f67736d6c x6 : ffffffc000904c40
x5 : ffffffc05b82f6b0 x4 : 000000000000005b
x3 : 0000000000000002 x2 : 000000002b5447b7
x1 : 0000000000000201 x0 : 0000000004821020

PC: 0xffffffc0005f0bcc:
0bcc  6b1c001f 54fffc41 128002b4 97ed401d 2a1403e0 a94153f3 a9425bf5 a94363f7
0bec  a9446bf9 a94573fb a8d17bfd d65f03c0 97ed4014 71000abf 54002220 71002abf
0c0c  54fff860 97ed400f 1100077b 6b13037f 54fff961 97ed400b f9404fb5 913a12b8
0c2c  aa1803e0 9402f8d9 79405343 aa1503e0 b9407fa4 aa1a03e1 91004342 97ffecd1
0c4c  f9400016 97ed3fff b40001f6 97ed3ffd aa1a03e0 910252c1 97ffee14 53001c00
0c6c  340000c0 97ed3ff7 3946e2c0 b940a3a1 6b01001f 54002bc0 97ed3ff2 f94002d6
0c8c  b5fffe36 12800017 d2800016 97ed3fed b9407fa0 f9404fa1 8b20cc20 f945ec15
0cac  97ed3fe8 b40001f5 97ed3fe6 aa1a03e0 910252a1 97ffedfd 53001c00 340000c0

LR: 0xffffffc0005f0bcc:
0bcc  6b1c001f 54fffc41 128002b4 97ed401d 2a1403e0 a94153f3 a9425bf5 a94363f7
0bec  a9446bf9 a94573fb a8d17bfd d65f03c0 97ed4014 71000abf 54002220 71002abf
0c0c  54fff860 97ed400f 1100077b 6b13037f 54fff961 97ed400b f9404fb5 913a12b8
0c2c  aa1803e0 9402f8d9 79405343 aa1503e0 b9407fa4 aa1a03e1 91004342 97ffecd1
0c4c  f9400016 97ed3fff b40001f6 97ed3ffd aa1a03e0 910252c1 97ffee14 53001c00
0c6c  340000c0 97ed3ff7 3946e2c0 b940a3a1 6b01001f 54002bc0 97ed3ff2 f94002d6
0c8c  b5fffe36 12800017 d2800016 97ed3fed b9407fa0 f9404fa1 8b20cc20 f945ec15
0cac  97ed3fe8 b40001f5 97ed3fe6 aa1a03e0 910252a1 97ffedfd 53001c00 340000c0

SP: 0xffffffc05b82f4e0:
f4e0  00000001 00000000 5b82f6d8 ffffffc0 00905ac4 ffffffc0 0000001a 00000000
f500  5d884298 ffffffc0 00000001 00000000 0000000a 00000000 5b82f560 ffffffc0
f520  005f0c4c ffffffc0 5b82f560 ffffffc0 005f0c4c ffffffc0 00000145 00000000
f540  00000001 00000000 005f0c34 ffffffc0 00000000 00000080 0000005b 00000000
f560  5b82f670 ffffffc0 005fd26c ffffffc0 00000000 00000000 5b82f724 ffffffc0
f580  5d884328 ffffffc0 00000001 00000000 5b82f6b0 ffffffc0 5d884288 ffffffc0
f5a0  0000001a 00000000 0070df48 ffffffc0 00000043 00000000 000000c8 00000000
f5c0  00921f65 ffffffc0 00836737 ffffffc0 5b82f6b0 ffffffc0 00836737 0000005b

X5: 0xffffffc05b82f630:
f630  00000053 00000000 00378804 ffffffc0 5b82f660 ffffffc0 000cffb4 ffffffc0
f650  008e13d0 ffffffc0 000001c0 00000000 5b82f670 ffffffc0 005fd244 ffffffc0
f670  5b82f8a0 ffffffc0 005fe21c ffffffc0 00000011 00000000 005fd0c8 ffffffc0
f690  5d884288 ffffffc0 000002a8 00000000 5d97b900 ffffffc0 00000000 00000000
f6b0  09000000 ffffff7f 08000000 04000000 08000000 00000000 00000000 00000000
f6d0  00000003 ffff0002 7f040000 00000000 00000000 00000000 06000000 00000000
f6f0  00000000 00000000 02000000 00000000 00000000 00000000 05000000 00000000
f710  00000000 00000000 00000232 00000005 3675000a ffffffc0 007ef230 ffffffc0

X6: 0xffffffc000904bc0:
4bc0  00908348 ffffffc0 00040000 00040000 00000080 00000011 00000000 00000000
4be0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4c00  00000010 00000000 00000001 00000000 00904c10 ffffffc0 00904c10 ffffffc0
4c20  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4c40  00000001 00000001 00020002 00000000 00905c68 ffffffc0 00905c68 ffffffc0
4c60  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4c80  008de0d8 ffffffc0 00000000 00000000 00000000 00000000 00000000 00000000
4ca0  00000000 00000000 00000000 00000000 f0000373 00000000 7d805a00 ffffffc0

X16: 0xffffffc0004e1b74:
1b74  f9406ab6 f94027a0 b4000396 97f17c33 aa1603e0 aa1903e1 910163a2 2a1803e3
1b94  d2800004 97fff3f8 93407c13 f9400ec0 34fffd77 f90027a0 97f17c28 f94027a0
1bb4  97f326cd 97f17c25 aa1303e0 a94157f3 a9425ff6 a94367f8 a8c97bfd d65f03c0
1bd4  97f17c1e aa1503e0 97f326c3 17ffffdd 92800113 17ffffdb 92800113 17ffffd4
1bf4  a9b77bfd 910003fd a90157f3 aa0203f5 aa0003f3 a90367f8 a9025ff6 aa0103f8
1c14  97f17c0e 37f80695 97f17c0c 2a1303e0 97f3b3a2 f27ef416 f90027a0 12000419
1c34  540005e0 97f17c05 92800af3 f94016c2 90001101 910a0021 f94027a0 eb01005f
1c54  540001c0 f90027a0 97f17bfc f94027a0 370003a0 97f17bf9 97f17bf8 97f17bf7

X20: 0xffffffc05b82f658:
f658  000001c0 00000000 5b82f670 ffffffc0 005fd244 ffffffc0 5b82f8a0 ffffffc0
f678  005fe21c ffffffc0 00000011 00000000 005fd0c8 ffffffc0 5d884288 ffffffc0
f698  000002a8 00000000 5d97b900 ffffffc0 00000000 00000000 09000000 ffffff7f
f6b8  08000000 04000000 08000000 00000000 00000000 00000000 00000003 ffff0002
f6d8  7f040000 00000000 00000000 00000000 06000000 00000000 00000000 00000000
f6f8  02000000 00000000 00000000 00000000 05000000 00000000 00000000 00000000
f718  00000232 00000005 3675000a ffffffc0 007ef230 ffffffc0 008e13d0 ffffffc0
f738  00000000 00000001 5b82f750 ffffffc0 000cc548 ffffffc0 5b82f760 ffffffc0

X21: 0xffffffc000904bc0:
4bc0  00908348 ffffffc0 00040000 00040000 00000080 00000011 00000000 00000000
4be0  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4c00  00000010 00000000 00000001 00000000 00904c10 ffffffc0 00904c10 ffffffc0
4c20  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4c40  00000001 00000001 00020002 00000000 00905c68 ffffffc0 00905c68 ffffffc0
4c60  00000000 00000000 00000000 00000000 00000000 00000000 00000000 00000000
4c80  008de0d8 ffffffc0 00000000 00000000 00000000 00000000 00000000 00000000
4ca0  00000000 00000000 00000000 00000000 f0000373 00000000 7d805a00 ffffffc0

X23: 0xffffffc05b82f658:
f658  000001c0 00000000 5b82f670 ffffffc0 005fd244 ffffffc0 5b82f8a0 ffffffc0
f678  005fe21c ffffffc0 00000011 00000000 005fd0c8 ffffffc0 5d884288 ffffffc0
f698  000002a8 00000000 5d97b900 ffffffc0 00000000 00000000 09000000 ffffff7f
f6b8  08000000 04000000 08000000 00000000 00000000 00000000 00000003 ffff0002
f6d8  7f040000 00000000 00000000 00000000 06000000 00000000 00000000 00000000
f6f8  02000000 00000000 00000000 00000000 05000000 00000000 00000000 00000000
f718  00000232 00000005 3675000a ffffffc0 007ef230 ffffffc0 008e13d0 ffffffc0
f738  00000000 00000001 5b82f750 ffffffc0 000cc548 ffffffc0 5b82f760 ffffffc0

X24: 0xffffffc000905a44:
5a44  ffffffc0 005eb958 ffffffc0 00645924 ffffffc0 0064596c ffffffc0 00659f1c
5a64  ffffffc0 005eb9c4 ffffffc0 7d96a700 ffffffc0 00000000 00000000 00000000
5a84  00000000 00000000 00000000 00905210 ffffffc0 00905090 ffffffc0 008c0efc
5aa4  ffffffc0 00000000 00000000 00000000 00000000 00000000 00000000 00140014
5ac4  00000001 00000000 00000000 00905ad0 ffffffc0 00905ad0 ffffffc0 5d953100
5ae4  ffffffc0 00000000 00000000 0000000a 00000000 008bf440 ffffffc0 0051de64
5b04  ffffffc0 008e53c0 ffffffc0 00000000 00000000 00000800 00001000 6219f7e0
5b24  ffffffc0 00928188 ffffffc0 00016100 00000001 00926d00 ffffffc0 0051cf6c

X26: 0xffffffc05d884218:
4218  06000000 07000000 05000000 04000000 00000000 00000000 00000000 520f0000
4238  00000000 00000000 00000000 000800ff 00000005 000a000a 0013002c 05000000
4258  80000000 04000000 7cc50000 03000000 00000000 00000000 00000000 00000003
4278  0000000a 000e000a 07ff0000 00000001 000000d8 00010021 00000fff 00000006
4298  09000000 09000000 05000000 01000080 ff000000 00000000 00000000 00000000
42b8  01008100 0400ff07 01fe0002 0000003f 00000e98 00001105 00000008 0000005b
42d8  00110050 7f040000 00000000 00000000 00000000 06000000 00000000 00000000
42f8  00000000 02000000 00000000 00000000 00000000 05000000 00000000 00000000

X29: 0xffffffc05b82f4e0:
f4e0  00000001 00000000 5b82f6d8 ffffffc0 00905ac4 ffffffc0 0000001a 00000000
f500  5d884298 ffffffc0 00000001 00000000 0000000a 00000000 5b82f560 ffffffc0
f520  005f0c4c ffffffc0 5b82f560 ffffffc0 005f0c4c ffffffc0 00000145 00000000
f540  00000001 00000000 005f0c34 ffffffc0 00000000 00000080 0000005b 00000000
f560  5b82f670 ffffffc0 005fd26c ffffffc0 00000000 00000000 5b82f724 ffffffc0
f580  5d884328 ffffffc0 00000001 00000000 5b82f6b0 ffffffc0 5d884288 ffffffc0
f5a0  0000001a 00000000 0070df48 ffffffc0 00000043 00000000 000000c8 00000000
f5c0  00921f65 ffffffc0 00836737 ffffffc0 5b82f6b0 ffffffc0 00836737 0000005b


Call trace:
[<ffffffc0005f0c4c>] xfrm_migrate+0x208/0x80c
[<ffffffc0005fd26c>] xfrm_do_migrate+0x1a4/0x1e8
[<ffffffc0005fe21c>] xfrm_user_rcv_msg+0x1fc/0x284
[<ffffffc00053beb0>] netlink_rcv_skb+0xf8/0x12c
[<ffffffc0005fcedc>] xfrm_netlink_rcv+0x34/0x48
[<ffffffc00053b558>] netlink_unicast+0x238/0x314
[<ffffffc00053ba9c>] netlink_sendmsg+0x2fc/0x3e0
[<ffffffc0004dc11c>] sock_sendmsg+0xc4/0x100
[<ffffffc0004def70>] ___sys_sendmsg+0x3f8/0x410
[<ffffffc0004e1cb8>] SyS_sendmsg+0xc4/0x10c
Code: b9407fa4 aa1a03e1 91004342 97ffecd1 (f9400016)
---[ end trace a42942d9d5e3d64d ]---
Kernel panic - not syncing: Fatal exception in interrupt