All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking
@ 2014-05-29  3:09 Eric Paris
  2014-05-29  3:09 ` [PATCH 2/2] audit: do not select HAVE_ARCH_AUDITSYSCALL on x32 Eric Paris
  2014-06-09 22:30 ` [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking Greg KH
  0 siblings, 2 replies; 23+ messages in thread
From: Eric Paris @ 2014-05-29  3:09 UTC (permalink / raw)
  To: torvalds; +Cc: linux-audit, linux-kernel, Andy Lutomirski, stable, Eric Paris

From: Andy Lutomirski <luto@amacapital.net>

Fixes an easy DoS and possible information disclosure.

This does nothing about the broken state of x32 auditing.

eparis: If the admin has enabled auditd and has specifically loaded audit
rules.  This bug has been around since before git.  Wow...

Cc: stable@vger.kernel.org
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Eric Paris <eparis@redhat.com>
---
 kernel/auditsc.c | 27 ++++++++++++++++++---------
 1 file changed, 18 insertions(+), 9 deletions(-)

diff --git a/kernel/auditsc.c b/kernel/auditsc.c
index 254ce20..842f58a 100644
--- a/kernel/auditsc.c
+++ b/kernel/auditsc.c
@@ -728,6 +728,22 @@ static enum audit_state audit_filter_task(struct task_struct *tsk, char **key)
 	return AUDIT_BUILD_CONTEXT;
 }
 
+static int audit_in_mask(const struct audit_krule *rule, unsigned long val)
+{
+	int word, bit;
+
+	if (val > 0xffffffff)
+		return false;
+
+	word = AUDIT_WORD(val);
+	if (word >= AUDIT_BITMASK_SIZE)
+		return false;
+
+	bit = AUDIT_BIT(val);
+
+	return rule->mask[word] & bit;
+}
+
 /* At syscall entry and exit time, this filter is called if the
  * audit_state is not low enough that auditing cannot take place, but is
  * also not high enough that we already know we have to write an audit
@@ -745,11 +761,8 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
 
 	rcu_read_lock();
 	if (!list_empty(list)) {
-		int word = AUDIT_WORD(ctx->major);
-		int bit  = AUDIT_BIT(ctx->major);
-
 		list_for_each_entry_rcu(e, list, list) {
-			if ((e->rule.mask[word] & bit) == bit &&
+			if (audit_in_mask(&e->rule, ctx->major) &&
 			    audit_filter_rules(tsk, &e->rule, ctx, NULL,
 					       &state, false)) {
 				rcu_read_unlock();
@@ -769,20 +782,16 @@ static enum audit_state audit_filter_syscall(struct task_struct *tsk,
 static int audit_filter_inode_name(struct task_struct *tsk,
 				   struct audit_names *n,
 				   struct audit_context *ctx) {
-	int word, bit;
 	int h = audit_hash_ino((u32)n->ino);
 	struct list_head *list = &audit_inode_hash[h];
 	struct audit_entry *e;
 	enum audit_state state;
 
-	word = AUDIT_WORD(ctx->major);
-	bit  = AUDIT_BIT(ctx->major);
-
 	if (list_empty(list))
 		return 0;
 
 	list_for_each_entry_rcu(e, list, list) {
-		if ((e->rule.mask[word] & bit) == bit &&
+		if (audit_in_mask(&e->rule, ctx->major) &&
 		    audit_filter_rules(tsk, &e->rule, ctx, n, &state, false)) {
 			ctx->current_state = state;
 			return 1;
-- 
1.9.0


^ permalink raw reply related	[flat|nested] 23+ messages in thread
* [PATCH 0/2] Fix auditsc DoS and move it to staging
@ 2014-05-28 22:21 Andy Lutomirski
  2014-05-28 22:21 ` [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking Andy Lutomirski
  0 siblings, 1 reply; 23+ messages in thread
From: Andy Lutomirski @ 2014-05-28 22:21 UTC (permalink / raw)
  To: Andy Lutomirski, Philipp Kern, H. Peter Anvin, linux-kernel,
	H. J. Lu, Eric Paris, security, greg

CONFIG_AUDITSYSCALL is awful.  Patch 2 enumerates some reasons.

Patch 1 fixes a nasty DoS and possible information leak.  It should
be applied and backported.

Patch 2 is optional.  I leave it to other peoples' judgment.

Andy Lutomirski (2):
  auditsc: audit_krule mask accesses need bounds checking
  audit: Move CONFIG_AUDITSYSCALL into staging and update help text

 init/Kconfig     | 13 ++++++++-----
 kernel/auditsc.c | 27 ++++++++++++++++++---------
 2 files changed, 26 insertions(+), 14 deletions(-)

-- 
1.9.3


^ permalink raw reply	[flat|nested] 23+ messages in thread
end of thread, other threads:[~2014-06-10 15:48 UTC | newest]

Thread overview: 23+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2014-05-29  3:09 [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking Eric Paris
2014-05-29  3:09 ` [PATCH 2/2] audit: do not select HAVE_ARCH_AUDITSYSCALL on x32 Eric Paris
2014-06-09 22:30 ` [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking Greg KH
2014-06-09 22:35   ` Andy Lutomirski
2014-06-09 22:46     ` Greg KH
2014-06-09 22:55       ` Andy Lutomirski
2014-06-10  0:32         ` Greg KH
2014-06-10  0:30           ` Andy Lutomirski
2014-06-10  0:37             ` Greg KH
2014-06-09 23:35       ` Josh Boyer
2014-06-10  0:31         ` Greg KH
2014-06-10  0:51           ` Andy Lutomirski
2014-06-10  2:57             ` Greg KH
2014-06-10  4:04               ` Andy Lutomirski
2014-06-10  4:14                 ` Greg KH
2014-06-09 22:53     ` Linus Torvalds
2014-06-09 22:56       ` Andy Lutomirski
2014-06-09 23:36         ` Linus Torvalds
2014-06-10 12:50           ` Eric Paris
2014-06-10 12:50             ` Eric Paris
2014-06-10 15:42             ` Linus Torvalds
2014-06-10 15:48               ` Linus Torvalds
  -- strict thread matches above, loose matches on Subject: below --
2014-05-28 22:21 [PATCH 0/2] Fix auditsc DoS and move it to staging Andy Lutomirski
2014-05-28 22:21 ` [PATCH 1/2] auditsc: audit_krule mask accesses need bounds checking Andy Lutomirski

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.