From: 张云海 <zhangyunhai@nsfocus.com>
To: Jiri Slaby <jirislaby@kernel.org>, Solar Designer <solar@openwall.com>
Cc: b.zolnierkie@samsung.com,
Yang Yingliang <yangyingliang@huawei.com>,
Kyungtae Kim <kt0755@gmail.com>,
Linus Torvalds <torvalds@linux-foundation.org>,
Greg KH <greg@kroah.com>,
"Srivatsa S. Bhat" <srivatsa@csail.mit.edu>,
Anthony Liguori <aliguori@amazon.com>,
xiao.zhang@windriver.com,
DRI devel <dri-devel@lists.freedesktop.org>,
Linux Fbdev development list <linux-fbdev@vger.kernel.org>,
Linux kernel mailing list <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH] vgacon: fix out of bounds write to the scrollback buffer
Date: Fri, 31 Jul 2020 13:22:28 +0800 [thread overview]
Message-ID: <9fb43895-ca91-9b07-ebfd-808cf854ca95@nsfocus.com> (raw)
In-Reply-To: <dbcf2841-7718-2ba7-11e0-efa4b9de8de1@nsfocus.com>
[-- Attachment #1: Type: text/plain, Size: 229 bytes --]
Remove whitespace at EOL
On 2020/7/30 18:39, 张云海 wrote:
> Update the patch, add CC list, sample output, and Jiri's PoC.
>
> On 2020/7/30 14:46, Jiri Slaby wrote:
>> Hi, OTOH, you should have CCed all the (public) lists.
>
[-- Attachment #2: 0001-Fix-for-missing-check-in-vgacon-scrollback-handling.patch --]
[-- Type: text/plain, Size: 2823 bytes --]
From ad143ede24ff4e61292cc9c96000100aacd97259 Mon Sep 17 00:00:00 2001
From: Yunhai Zhang <zhangyunhai@nsfocus.com>
Date: Tue, 28 Jul 2020 09:58:03 +0800
Subject: [PATCH] Fix for missing check in vgacon scrollback handling
vgacon_scrollback_update() always leaves enbough room in the scrollback
buffer for the next call, but if the console size changed that room
might not actually be enough, and so we need to re-check.
The check should be in the loop since vgacon_scrollback_cur->tail is
updated in the loop and count may be more than 1 when triggered by CSI M,
as Jiri's PoC:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <fcntl.h>
int main(int argc, char** argv)
{
int fd = open("/dev/tty1", O_RDWR);
unsigned short size[3] = {25, 200, 0};
ioctl(fd, 0x5609, size); // VT_RESIZE
write(fd, "\e[1;1H", 6);
for (int i = 0; i < 30; i++)
write(fd, "\e[10M", 5);
}
It leads to various crashes as vgacon_scrollback_update writes out of
the buffer:
BUG: unable to handle page fault for address: ffffc900001752a0
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
RIP: 0010:mutex_unlock+0x13/0x30
...
Call Trace:
n_tty_write+0x1a0/0x4d0
tty_write+0x1a0/0x2e0
Or to KASAN reports:
BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed
This fixes CVE-2020-14331.
Reported-and-debugged-by: 张云海 <zhangyunhai@nsfocus.com>
Reported-and-debugged-by: Yang Yingliang <yangyingliang@huawei.com>
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
Cc: stable@vger.kernel.org
Cc: linux-fbdev@vger.kernel.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg KH <greg@kroah.com>
Cc: Solar Designer <solar@openwall.com>
Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Yunhai Zhang <zhangyunhai@nsfocus.com>
---
drivers/video/console/vgacon.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 998b0de1812f..37b5711cd958 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
p = (void *) (c->vc_origin + t * c->vc_size_row);
while (count--) {
+ if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
+ vgacon_scrollback_cur->size)
+ vgacon_scrollback_cur->tail = 0;
+
scr_memcpyw(vgacon_scrollback_cur->data +
vgacon_scrollback_cur->tail,
p, c->vc_size_row);
--
2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: 张云海 <zhangyunhai@nsfocus.com>
To: Jiri Slaby <jirislaby@kernel.org>, Solar Designer <solar@openwall.com>
Cc: Linux Fbdev development list <linux-fbdev@vger.kernel.org>,
Kyungtae Kim <kt0755@gmail.com>,
b.zolnierkie@samsung.com, Greg KH <greg@kroah.com>,
Linux kernel mailing list <linux-kernel@vger.kernel.org>,
DRI devel <dri-devel@lists.freedesktop.org>,
Anthony Liguori <aliguori@amazon.com>,
Yang Yingliang <yangyingliang@huawei.com>,
xiao.zhang@windriver.com,
Linus Torvalds <torvalds@linux-foundation.org>,
"Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Subject: Re: [PATCH] vgacon: fix out of bounds write to the scrollback buffer
Date: Fri, 31 Jul 2020 05:22:28 +0000 [thread overview]
Message-ID: <9fb43895-ca91-9b07-ebfd-808cf854ca95@nsfocus.com> (raw)
In-Reply-To: <dbcf2841-7718-2ba7-11e0-efa4b9de8de1@nsfocus.com>
[-- Attachment #1: Type: text/plain, Size: 229 bytes --]
Remove whitespace at EOL
On 2020/7/30 18:39, 张云海 wrote:
> Update the patch, add CC list, sample output, and Jiri's PoC.
>
> On 2020/7/30 14:46, Jiri Slaby wrote:
>> Hi, OTOH, you should have CCed all the (public) lists.
>
[-- Attachment #2: 0001-Fix-for-missing-check-in-vgacon-scrollback-handling.patch --]
[-- Type: text/plain, Size: 2823 bytes --]
From ad143ede24ff4e61292cc9c96000100aacd97259 Mon Sep 17 00:00:00 2001
From: Yunhai Zhang <zhangyunhai@nsfocus.com>
Date: Tue, 28 Jul 2020 09:58:03 +0800
Subject: [PATCH] Fix for missing check in vgacon scrollback handling
vgacon_scrollback_update() always leaves enbough room in the scrollback
buffer for the next call, but if the console size changed that room
might not actually be enough, and so we need to re-check.
The check should be in the loop since vgacon_scrollback_cur->tail is
updated in the loop and count may be more than 1 when triggered by CSI M,
as Jiri's PoC:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <fcntl.h>
int main(int argc, char** argv)
{
int fd = open("/dev/tty1", O_RDWR);
unsigned short size[3] = {25, 200, 0};
ioctl(fd, 0x5609, size); // VT_RESIZE
write(fd, "\e[1;1H", 6);
for (int i = 0; i < 30; i++)
write(fd, "\e[10M", 5);
}
It leads to various crashes as vgacon_scrollback_update writes out of
the buffer:
BUG: unable to handle page fault for address: ffffc900001752a0
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
RIP: 0010:mutex_unlock+0x13/0x30
...
Call Trace:
n_tty_write+0x1a0/0x4d0
tty_write+0x1a0/0x2e0
Or to KASAN reports:
BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed
This fixes CVE-2020-14331.
Reported-and-debugged-by: 张云海 <zhangyunhai@nsfocus.com>
Reported-and-debugged-by: Yang Yingliang <yangyingliang@huawei.com>
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
Cc: stable@vger.kernel.org
Cc: linux-fbdev@vger.kernel.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg KH <greg@kroah.com>
Cc: Solar Designer <solar@openwall.com>
Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Yunhai Zhang <zhangyunhai@nsfocus.com>
---
drivers/video/console/vgacon.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 998b0de1812f..37b5711cd958 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
p = (void *) (c->vc_origin + t * c->vc_size_row);
while (count--) {
+ if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
+ vgacon_scrollback_cur->size)
+ vgacon_scrollback_cur->tail = 0;
+
scr_memcpyw(vgacon_scrollback_cur->data +
vgacon_scrollback_cur->tail,
p, c->vc_size_row);
--
2.25.1
WARNING: multiple messages have this Message-ID (diff)
From: 张云海 <zhangyunhai@nsfocus.com>
To: Jiri Slaby <jirislaby@kernel.org>, Solar Designer <solar@openwall.com>
Cc: Linux Fbdev development list <linux-fbdev@vger.kernel.org>,
Kyungtae Kim <kt0755@gmail.com>,
b.zolnierkie@samsung.com, Greg KH <greg@kroah.com>,
Linux kernel mailing list <linux-kernel@vger.kernel.org>,
DRI devel <dri-devel@lists.freedesktop.org>,
Anthony Liguori <aliguori@amazon.com>,
Yang Yingliang <yangyingliang@huawei.com>,
xiao.zhang@windriver.com,
Linus Torvalds <torvalds@linux-foundation.org>,
"Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Subject: Re: [PATCH] vgacon: fix out of bounds write to the scrollback buffer
Date: Fri, 31 Jul 2020 13:22:28 +0800 [thread overview]
Message-ID: <9fb43895-ca91-9b07-ebfd-808cf854ca95@nsfocus.com> (raw)
In-Reply-To: <dbcf2841-7718-2ba7-11e0-efa4b9de8de1@nsfocus.com>
[-- Attachment #1: Type: text/plain, Size: 229 bytes --]
Remove whitespace at EOL
On 2020/7/30 18:39, 张云海 wrote:
> Update the patch, add CC list, sample output, and Jiri's PoC.
>
> On 2020/7/30 14:46, Jiri Slaby wrote:
>> Hi, OTOH, you should have CCed all the (public) lists.
>
[-- Attachment #2: 0001-Fix-for-missing-check-in-vgacon-scrollback-handling.patch --]
[-- Type: text/plain, Size: 2823 bytes --]
From ad143ede24ff4e61292cc9c96000100aacd97259 Mon Sep 17 00:00:00 2001
From: Yunhai Zhang <zhangyunhai@nsfocus.com>
Date: Tue, 28 Jul 2020 09:58:03 +0800
Subject: [PATCH] Fix for missing check in vgacon scrollback handling
vgacon_scrollback_update() always leaves enbough room in the scrollback
buffer for the next call, but if the console size changed that room
might not actually be enough, and so we need to re-check.
The check should be in the loop since vgacon_scrollback_cur->tail is
updated in the loop and count may be more than 1 when triggered by CSI M,
as Jiri's PoC:
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/ioctl.h>
#include <fcntl.h>
int main(int argc, char** argv)
{
int fd = open("/dev/tty1", O_RDWR);
unsigned short size[3] = {25, 200, 0};
ioctl(fd, 0x5609, size); // VT_RESIZE
write(fd, "\e[1;1H", 6);
for (int i = 0; i < 30; i++)
write(fd, "\e[10M", 5);
}
It leads to various crashes as vgacon_scrollback_update writes out of
the buffer:
BUG: unable to handle page fault for address: ffffc900001752a0
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
RIP: 0010:mutex_unlock+0x13/0x30
...
Call Trace:
n_tty_write+0x1a0/0x4d0
tty_write+0x1a0/0x2e0
Or to KASAN reports:
BUG: KASAN: slab-out-of-bounds in vgacon_scroll+0x57a/0x8ed
This fixes CVE-2020-14331.
Reported-and-debugged-by: 张云海 <zhangyunhai@nsfocus.com>
Reported-and-debugged-by: Yang Yingliang <yangyingliang@huawei.com>
Reported-by: Kyungtae Kim <kt0755@gmail.com>
Fixes: 15bdab959c9b ([PATCH] vgacon: Add support for soft scrollback)
Cc: stable@vger.kernel.org
Cc: linux-fbdev@vger.kernel.org
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Greg KH <greg@kroah.com>
Cc: Solar Designer <solar@openwall.com>
Cc: "Srivatsa S. Bhat" <srivatsa@csail.mit.edu>
Cc: Anthony Liguori <aliguori@amazon.com>
Cc: Yang Yingliang <yangyingliang@huawei.com>
Cc: Bartlomiej Zolnierkiewicz <b.zolnierkie@samsung.com>
Signed-off-by: Yunhai Zhang <zhangyunhai@nsfocus.com>
---
drivers/video/console/vgacon.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
index 998b0de1812f..37b5711cd958 100644
--- a/drivers/video/console/vgacon.c
+++ b/drivers/video/console/vgacon.c
@@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
p = (void *) (c->vc_origin + t * c->vc_size_row);
while (count--) {
+ if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
+ vgacon_scrollback_cur->size)
+ vgacon_scrollback_cur->tail = 0;
+
scr_memcpyw(vgacon_scrollback_cur->data +
vgacon_scrollback_cur->tail,
p, c->vc_size_row);
--
2.25.1
[-- Attachment #3: Type: text/plain, Size: 160 bytes --]
_______________________________________________
dri-devel mailing list
dri-devel@lists.freedesktop.org
https://lists.freedesktop.org/mailman/listinfo/dri-devel
next prev parent reply other threads:[~2020-07-31 5:22 UTC|newest]
Thread overview: 48+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20200729130710.GA13262@openwall.com>
[not found] ` <b764c575-70be-80dd-6718-e84370a7b2b3@nsfocus.com>
2020-07-30 6:46 ` [PATCH] vgacon: fix out of bounds write to the scrollback buffer Jiri Slaby
2020-07-30 6:46 ` Jiri Slaby
2020-07-30 6:46 ` Jiri Slaby
2020-07-30 7:38 ` Jiri Slaby
2020-07-30 7:38 ` Jiri Slaby
2020-07-30 7:38 ` Jiri Slaby
2020-07-30 10:39 ` 张云海
2020-07-30 10:39 ` 张云海
2020-07-30 10:39 ` 张云海
2020-07-31 5:22 ` 张云海 [this message]
2020-07-31 5:22 ` 张云海
2020-07-31 5:22 ` 张云海
2020-08-03 8:08 ` Jiri Slaby
2020-08-03 8:08 ` Jiri Slaby
2020-08-03 8:08 ` Jiri Slaby
2020-08-03 8:18 ` Greg KH
2020-08-03 8:18 ` Greg KH
2020-08-03 8:18 ` Greg KH
2020-08-03 8:45 ` Daniel Vetter
2020-08-03 8:45 ` Daniel Vetter
2020-08-03 8:45 ` Daniel Vetter
2020-08-03 9:47 ` Greg KH
2020-08-03 9:47 ` Greg KH
2020-08-03 9:47 ` Greg KH
2020-08-03 11:07 ` Bartlomiej Zolnierkiewicz
2020-08-03 11:07 ` Bartlomiej Zolnierkiewicz
2020-08-03 11:07 ` Bartlomiej Zolnierkiewicz
2020-08-04 7:37 ` Greg KH
2020-08-04 7:37 ` Greg KH
2020-08-04 7:37 ` Greg KH
[not found] <CGME20200729070257eucas1p1f5841756104301e67907136e45d6e9f5@eucas1p1.samsung.com>
2020-07-29 7:02 ` Jiri Slaby
2020-07-29 7:02 ` Jiri Slaby
2020-07-29 7:02 ` Jiri Slaby
2020-07-29 7:53 ` 张云海
2020-07-29 7:53 ` 张云海
2020-07-29 7:53 ` 张云海
2020-07-29 8:11 ` Jiri Slaby
2020-07-29 8:11 ` Jiri Slaby
2020-07-29 8:11 ` Jiri Slaby
2020-07-29 8:19 ` 张云海
2020-07-29 8:19 ` 张云海
2020-07-29 8:19 ` 张云海
2020-07-29 11:20 ` Jiri Slaby
2020-07-29 11:20 ` Jiri Slaby
2020-07-29 11:20 ` Jiri Slaby
2020-07-29 13:37 ` Bartlomiej Zolnierkiewicz
2020-07-29 13:37 ` Bartlomiej Zolnierkiewicz
2020-07-29 13:37 ` Bartlomiej Zolnierkiewicz
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9fb43895-ca91-9b07-ebfd-808cf854ca95@nsfocus.com \
--to=zhangyunhai@nsfocus.com \
--cc=aliguori@amazon.com \
--cc=b.zolnierkie@samsung.com \
--cc=dri-devel@lists.freedesktop.org \
--cc=greg@kroah.com \
--cc=jirislaby@kernel.org \
--cc=kt0755@gmail.com \
--cc=linux-fbdev@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=solar@openwall.com \
--cc=srivatsa@csail.mit.edu \
--cc=torvalds@linux-foundation.org \
--cc=xiao.zhang@windriver.com \
--cc=yangyingliang@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.