* Potentially interesting memcpy/memset/memmove calls
@ 2021-08-16 16:27 Jordy Zomer
2021-08-16 19:11 ` Jordy Zomer
0 siblings, 1 reply; 2+ messages in thread
From: Jordy Zomer @ 2021-08-16 16:27 UTC (permalink / raw)
To: linux-hardening; +Cc: keescook
Hiya!
Kees asked me to develop a query to detect calls where the destinations could need some attention as part of his initiative to harden memcpy calls.
Regarding:
(https://lore.kernel.org/lkml/20210727205855.411487-1-keescook@chromium.org/)
As a result, I created a CodeQL query to detect some questionable instances. This query identifies a struct having a flexible array member when it is supplied as a reference to memcpy/memmove/memset's first argument. The query was performed on 5.13.11.
I'm now compiling a database with `make allmodconfig` to see if it finds anything else, but you can see the preliminary findings below.
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/fpu/core.c?h=v5.13.11#n229
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kvm/x86.c?h=v5.13.11#n10972
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n500
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n528
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n536
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/message/fusion/mptbase.c?h=v5.13.11#n1854
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/arcnet/arcnet.c?h=v5.13.11#n1145
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c?h=v5.13.11#n336
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c?h=v5.13.11#n74
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/sony-laptop.c?h=v5.13.11#n4529
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/sony-laptop.c?h=v5.13.11#n4548
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/scsi/be2iscsi/be_mgmt.c?h=v5.13.11#n865
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/w1/w1_netlink.c?h=v5.13.11#n614
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/w1/w1_netlink.c?h=v5.13.11#n199
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7007
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7011
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/ethtool/ioctl.c?h=v5.13.11#n450
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/ipv4/devinet.c?h=v5.13.11#n262
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n1037
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n831
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/virt/kvm/kvm_main.c?h=v5.13.11#n1506
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/virt/kvm/kvm_main.c?h=v5.13.11#n1522
Best Regards,
Jordy Zomer
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Potentially interesting memcpy/memset/memmove calls
2021-08-16 16:27 Potentially interesting memcpy/memset/memmove calls Jordy Zomer
@ 2021-08-16 19:11 ` Jordy Zomer
0 siblings, 0 replies; 2+ messages in thread
From: Jordy Zomer @ 2021-08-16 19:11 UTC (permalink / raw)
To: linux-hardening; +Cc: keescook
Hi There!
I just re-ran the query and added a check to see whether the size argument of those functions isn't a constant; this should eliminate a lot of false positives. The amended list with fewer results can be found below (still ran on the same database).
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/fpu/core.c?h=v5.13.11#n229
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n500
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n528
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n536
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c?h=v5.13.11#n74
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/w1/w1_netlink.c?h=v5.13.11#n614
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7007
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7011
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n1037
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n831
Best Regards,
Jordy Zomer
> On 08/16/2021 12:27 PM Jordy Zomer <jordy@pwning.systems> wrote:
>
>
> Hiya!
>
> Kees asked me to develop a query to detect calls where the destinations could need some attention as part of his initiative to harden memcpy calls.
>
> Regarding:
> (https://lore.kernel.org/lkml/20210727205855.411487-1-keescook@chromium.org/)
>
> As a result, I created a CodeQL query to detect some questionable instances. This query identifies a struct having a flexible array member when it is supplied as a reference to memcpy/memmove/memset's first argument. The query was performed on 5.13.11.
> I'm now compiling a database with `make allmodconfig` to see if it finds anything else, but you can see the preliminary findings below.
>
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/fpu/core.c?h=v5.13.11#n229
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kvm/x86.c?h=v5.13.11#n10972
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n500
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n528
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n536
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/message/fusion/mptbase.c?h=v5.13.11#n1854
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/arcnet/arcnet.c?h=v5.13.11#n1145
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c?h=v5.13.11#n336
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c?h=v5.13.11#n74
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/sony-laptop.c?h=v5.13.11#n4529
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/sony-laptop.c?h=v5.13.11#n4548
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/scsi/be2iscsi/be_mgmt.c?h=v5.13.11#n865
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/w1/w1_netlink.c?h=v5.13.11#n614
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/w1/w1_netlink.c?h=v5.13.11#n199
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7007
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7011
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/ethtool/ioctl.c?h=v5.13.11#n450
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/ipv4/devinet.c?h=v5.13.11#n262
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n1037
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n831
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/virt/kvm/kvm_main.c?h=v5.13.11#n1506
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/virt/kvm/kvm_main.c?h=v5.13.11#n1522
>
>
> Best Regards,
>
> Jordy Zomer
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2021-08-16 19:11 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-08-16 16:27 Potentially interesting memcpy/memset/memmove calls Jordy Zomer
2021-08-16 19:11 ` Jordy Zomer
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).