From: Jann Horn <jann@thejh.net> To: Andrew Morton <akpm@linux-foundation.org>, "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>, Vlastimil Babka <vbabka@suse.cz>, Johannes Weiner <hannes@cmpxchg.org>, Jerome Marchand <jmarchan@redhat.com> Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH] swapfile: fix memory corruption via malformed swapfile Date: Mon, 31 Oct 2016 22:32:13 +0100 [thread overview] Message-ID: <1477949533-2509-1-git-send-email-jann@thejh.net> (raw) When root activates a swap partition whose header has the wrong endianness, nr_badpages elements of badpages are swabbed before nr_badpages has been checked, leading to a buffer overrun of up to 8GB. This normally is not a security issue because it can only be exploited by root (more specifically, a process with CAP_SYS_ADMIN or the ability to modify a swap file/partition), and such a process can already e.g. modify swapped-out memory of any other userspace process on the system. Testcase for reproducing the bug (must be run as root, should crash your kernel): ================= #include <stdlib.h> #include <unistd.h> #include <sys/swap.h> #include <limits.h> #include <err.h> #include <string.h> #include <stdio.h> #define PAGE_SIZE 4096 #define __u32 unsigned int // from include/linux/swap.h union swap_header { struct { char reserved[PAGE_SIZE - 10]; char magic[10]; /* SWAP-SPACE or SWAPSPACE2 */ } magic; struct { char bootbits[1024]; /* Space for disklabel etc. */ __u32 version; __u32 last_page; __u32 nr_badpages; unsigned char sws_uuid[16]; unsigned char sws_volume[16]; __u32 padding[117]; __u32 badpages[1]; } info; }; int main(void) { char file[] = "/tmp/swapfile.XXXXXX"; int file_fd = mkstemp(file); if (file_fd == -1) err(1, "mkstemp"); if (ftruncate(file_fd, PAGE_SIZE)) err(1, "ftruncate"); union swap_header swap_header = { .info = { .version = __builtin_bswap32(1), .nr_badpages = __builtin_bswap32(INT_MAX) } }; memcpy(swap_header.magic.magic, "SWAPSPACE2", 10); if (write(file_fd, &swap_header, sizeof(swap_header)) != sizeof(swap_header)) err(1, "write"); // not because the attack needs it, just in case you forgot to // sync yourself before crashing your machine sync(); // now die if (swapon(file, 0)) err(1, "swapon"); puts("huh, we survived"); if (swapoff(file)) err(1, "swapoff"); unlink(file); } ================= Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jann@thejh.net> --- mm/swapfile.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/swapfile.c b/mm/swapfile.c index 2210de290b54..f30438970cd1 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -2224,6 +2224,8 @@ static unsigned long read_swap_header(struct swap_info_struct *p, swab32s(&swap_header->info.version); swab32s(&swap_header->info.last_page); swab32s(&swap_header->info.nr_badpages); + if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES) + return 0; for (i = 0; i < swap_header->info.nr_badpages; i++) swab32s(&swap_header->info.badpages[i]); } -- 2.1.4
WARNING: multiple messages have this Message-ID (diff)
From: Jann Horn <jann@thejh.net> To: Andrew Morton <akpm@linux-foundation.org>, "Kirill A. Shutemov" <kirill.shutemov@linux.intel.com>, Vlastimil Babka <vbabka@suse.cz>, Johannes Weiner <hannes@cmpxchg.org>, Jerome Marchand <jmarchan@redhat.com> Cc: linux-mm@kvack.org, linux-kernel@vger.kernel.org Subject: [PATCH] swapfile: fix memory corruption via malformed swapfile Date: Mon, 31 Oct 2016 22:32:13 +0100 [thread overview] Message-ID: <1477949533-2509-1-git-send-email-jann@thejh.net> (raw) When root activates a swap partition whose header has the wrong endianness, nr_badpages elements of badpages are swabbed before nr_badpages has been checked, leading to a buffer overrun of up to 8GB. This normally is not a security issue because it can only be exploited by root (more specifically, a process with CAP_SYS_ADMIN or the ability to modify a swap file/partition), and such a process can already e.g. modify swapped-out memory of any other userspace process on the system. Testcase for reproducing the bug (must be run as root, should crash your kernel): ================= #include <stdlib.h> #include <unistd.h> #include <sys/swap.h> #include <limits.h> #include <err.h> #include <string.h> #include <stdio.h> #define PAGE_SIZE 4096 #define __u32 unsigned int // from include/linux/swap.h union swap_header { struct { char reserved[PAGE_SIZE - 10]; char magic[10]; /* SWAP-SPACE or SWAPSPACE2 */ } magic; struct { char bootbits[1024]; /* Space for disklabel etc. */ __u32 version; __u32 last_page; __u32 nr_badpages; unsigned char sws_uuid[16]; unsigned char sws_volume[16]; __u32 padding[117]; __u32 badpages[1]; } info; }; int main(void) { char file[] = "/tmp/swapfile.XXXXXX"; int file_fd = mkstemp(file); if (file_fd == -1) err(1, "mkstemp"); if (ftruncate(file_fd, PAGE_SIZE)) err(1, "ftruncate"); union swap_header swap_header = { .info = { .version = __builtin_bswap32(1), .nr_badpages = __builtin_bswap32(INT_MAX) } }; memcpy(swap_header.magic.magic, "SWAPSPACE2", 10); if (write(file_fd, &swap_header, sizeof(swap_header)) != sizeof(swap_header)) err(1, "write"); // not because the attack needs it, just in case you forgot to // sync yourself before crashing your machine sync(); // now die if (swapon(file, 0)) err(1, "swapon"); puts("huh, we survived"); if (swapoff(file)) err(1, "swapoff"); unlink(file); } ================= Cc: stable@vger.kernel.org Signed-off-by: Jann Horn <jann@thejh.net> --- mm/swapfile.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/swapfile.c b/mm/swapfile.c index 2210de290b54..f30438970cd1 100644 --- a/mm/swapfile.c +++ b/mm/swapfile.c @@ -2224,6 +2224,8 @@ static unsigned long read_swap_header(struct swap_info_struct *p, swab32s(&swap_header->info.version); swab32s(&swap_header->info.last_page); swab32s(&swap_header->info.nr_badpages); + if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES) + return 0; for (i = 0; i < swap_header->info.nr_badpages; i++) swab32s(&swap_header->info.badpages[i]); } -- 2.1.4 -- To unsubscribe, send a message with 'unsubscribe linux-mm' in the body to majordomo@kvack.org. For more info on Linux MM, see: http://www.linux-mm.org/ . Don't email: <a href=mailto:"dont@kvack.org"> email@kvack.org </a>
next reply other threads:[~2016-10-31 21:32 UTC|newest] Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top 2016-10-31 21:32 Jann Horn [this message] 2016-10-31 21:32 ` [PATCH] swapfile: fix memory corruption via malformed swapfile Jann Horn 2016-10-31 22:36 ` Kees Cook 2016-10-31 22:36 ` Kees Cook 2016-11-01 9:10 ` Jerome Marchand 2016-11-04 14:57 ` Johannes Weiner 2016-11-04 14:57 ` Johannes Weiner
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1477949533-2509-1-git-send-email-jann@thejh.net \ --to=jann@thejh.net \ --cc=akpm@linux-foundation.org \ --cc=hannes@cmpxchg.org \ --cc=jmarchan@redhat.com \ --cc=kirill.shutemov@linux.intel.com \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-mm@kvack.org \ --cc=vbabka@suse.cz \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.