From: Alexey Izbyshev <izbyshev@ispras.ru>
To: Alexey Dobriyan <adobriyan@gmail.com>
Cc: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org,
security@kernel.org, Alexey Izbyshev <izbyshev@ispras.ru>,
Oleg Nesterov <oleg@redhat.com>
Subject: [PATCH] proc: Fix uninitialized byte read in get_mm_cmdline()
Date: Fri, 12 Jul 2019 19:09:13 +0300 [thread overview]
Message-ID: <20190712160913.17727-1-izbyshev@ispras.ru> (raw)
get_mm_cmdline() leaks an uninitialized byte located at
user-controlled offset in a newly-allocated kernel page in
the following scenario.
- When reading the last chunk of cmdline, access_remote_vm()
fails to copy the requested number of bytes, but still copies
enough bytes so that we get into the body of
"if (pos + got >= arg_end)" statement. This can be arranged by user,
for example, by applying mprotect(PROT_NONE) to the env block.
- strnlen() doesn't find a NUL byte. This too can be arranged
by user via suitable modifications of argument and env blocks.
- The above causes the following condition to be true despite
that no NUL byte was found:
/* Include the NUL if it existed */
if (got < size)
got++;
The resulting increment causes the subsequent copy_to_user()
to copy an extra byte from "page" to userspace. That byte might
come from previous uses of memory referred by "page" before
it was allocated by get_mm_cmdline(), potentially leaking
data belonging to other processes or kernel.
Fix this by ensuring that "size + offset" doesn't exceed the number
of bytes copied by access_remote_vm().
Fixes: f5b65348fd77 ("proc: fix missing final NUL in get_mm_cmdline() rewrite")
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Alexey Izbyshev <izbyshev@ispras.ru>
---
This patch was initially sent to <security@kernel.org> accompanied
with a little program that exploits the bug to dump the kernel page
used in get_mm_cmdline().
Thanks to Oleg Nesterov and Laura Abbott for their feedback!
fs/proc/base.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/fs/proc/base.c b/fs/proc/base.c
index 255f6754c70d..6e30dd791761 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -275,6 +275,8 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
if (got <= offset)
break;
got -= offset;
+ if (got < size)
+ size = got;
/* Don't walk past a NUL character once you hit arg_end */
if (pos + got >= arg_end) {
--
2.21.0
next reply other threads:[~2019-07-12 16:18 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-12 16:09 Alexey Izbyshev [this message]
2019-07-12 16:36 ` [PATCH] proc: Fix uninitialized byte read in get_mm_cmdline() Oleg Nesterov
2019-07-12 17:46 ` Alexey Dobriyan
2019-07-12 18:43 ` Alexey Izbyshev
2019-07-12 21:17 ` Jakub Jankowski
2019-07-12 22:29 ` Alexey Izbyshev
2019-07-13 7:26 ` Alexey Dobriyan
2019-07-13 14:09 ` Alexey Izbyshev
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190712160913.17727-1-izbyshev@ispras.ru \
--to=izbyshev@ispras.ru \
--cc=adobriyan@gmail.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=oleg@redhat.com \
--cc=security@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).