linux-kernel - Re: [PATCH] getsockopt() early argument sanity checking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 21 Aug 2006 03:00:22 +0000 (UTC)
From:	daw@...berkeley.edu (David Wagner)
To:	linux-kernel@...r.kernel.org
Subject: Re: [PATCH] getsockopt() early argument sanity checking

Solar Designer  wrote:
>The patch makes getsockopt(2) sanity-check the value pointed to by
>the optlen argument early on.  This is a security hardening measure
>intended to prevent exploitation of certain potential vulnerabilities in
>socket type specific getsockopt() code on UP systems.

This looks broken to me.  It has a TOCTTOU (time-of-check-to-time-of-use)
vulnerability (i.e., race condition): you read the length value twice,
and assume that you will get the same value both times.  That assumption
is not valid.

It looks like it will be easy to bypass this check.  For instance,
think about what happens if an adversary stores the length field in a
mmaped region, for instance.  It should be easy for the value of that
length field to change between when it was first read and when it was
subsequently read.  I don't see how this provides any "hardening" if
the attacker knows how to read kernel source code.  Am I missing
something?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/