A vulnerability has been discovered in the XFS file system code (CVE-2021-4155) that allows a local unprivileged user to read data from unused blocks directly from the block device. All significant versions of the Linux kernel later than 5.16 that include the XFS driver are affected by this issue. The fix has been included in version 5.16 as well as in the updates for kernels 5.15.14, 5.10.91, 5.4.171, 4.19.225, etc. The status of updates addressing the issue in distributions can be tracked on the following pages: Debian, RHEL, SUSE, Fedora, Ubuntu, Arch.
The vulnerability is caused by incorrect behavior of two XFS-specific ioctls (XFS_IOC_ALLOCSP and XFS_IOC_FREESP) that function similarly to the generic kernel system call fallocate(). When increasing the size of a file that is not aligned to the block size, the ioctls XFS_IOC_ALLOCSP/XFS_IOC_FREESP do not zero out the tail bytes up to the next block boundary. Consequently, on XFS with a standard block size of 4096 bytes, an attacker can read up to 4095 bytes of previously written data from each block. These areas may contain data from deleted files, defragmented files, as well as files with deduplicated blocks.
You can check your system for the problem using a simple exploit prototype. If, after executing the proposed sequence of commands, you can read Shakespeare's text, then the filesystem driver is vulnerable. The initial mounting of the XFS partition for demonstration requires superuser rights.
Since ioctl(XFS_IOC_ALLOCSP) and ioctl(XFS_IOC_FREESP) are functionally almost indistinguishable from the standard fallocate(), and their only difference is the data leak, their presence resembles a backdoor. Despite the general policy of not modifying existing interfaces in the kernel, it was decided, at Linus's suggestion, to completely remove these ioctls in the next version.
Source: opennet.ru
