linux-kernel - Re: v2.6.28-rc1: readlink /proc/*/exe returns uninitialized data to userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 6 Nov 2008 11:04:10 +0100
From:	Ingo Molnar <mingo@...e.hu>
To:	Al Viro <viro@...IV.linux.org.uk>
Cc:	Vegard Nossum <vegard.nossum@...il.com>,
	"Eric W. Biederman" <ebiederm@...ssion.com>,
	"Koyama, Yoshiya" <Yoshiya.Koyama@...com>,
	"Rafael J. Wysocki" <rjw@...k.pl>,
	Alexey Dobriyan <adobriyan@...il.com>,
	Pekka Enberg <penberg@...helsinki.fi>,
	LKML <linux-kernel@...r.kernel.org>, Greg KH <greg@...ah.com>,
	Kay Sievers <kay.sievers@...y.org>,
	linux-fsdevel@...r.kernel.org
Subject: Re: v2.6.28-rc1: readlink /proc/*/exe returns uninitialized data
	to userspace


* Al Viro <viro@...IV.linux.org.uk> wrote:

> On Tue, Nov 04, 2008 at 10:39:19AM +0100, Vegard Nossum wrote:
> > On Sun, Oct 26, 2008 at 10:08 PM, Vegard Nossum <vegard.nossum@...il.com> wrote:
> > # uname -a
> > Linux localhost.localdomain 2.6.25.11-97.fc9.i686 #1 SMP Mon Jul 21
> > 01:31:09 EDT 2008 i686 i686 i386 GNU/Linux
> > # prelink -mRf /sbin/udevd
> > # ./a.out /proc/564/exe
> > warning: /proc/564/exe: got return value 38, expected 11
> > 2f7362696e2f7564657664005f47387942426e5952446e566f306868202864656c6574656429
> > /sbin/udevd _G8yBBnYRDnVo0hh (deleted)
> > 
> > Yoshiya Koyama reports that the problem exists on RHEL 2.6.9-42.ELsmp too.
> > 
> > I don't think it's exactly the same problem as originally reported,
> > because I definitely wasn't using prelinking (the prelink binary
> > wasn't even installed on the machine until today). But finding the
> > root cause of this may solve both problems.
> 
> switch_names() buggered in case of short names on both sides.  That should
> help:
> 
> >From 2acda856910b774717e0290bbf948c7dee0f2e1a Mon Sep 17 00:00:00 2001
> From: Al Viro <viro@...iv.linux.org.uk>
> Date: Mon, 3 Nov 2008 15:03:50 -0500
> Subject: [PATCH] fix switch_names() breakage in short-to-short case
> 
> We want ->name.len to match the resulting name on *both*
> source and target
> 
> Signed-off-by: Al Viro <viro@...iv.linux.org.uk>

please credit kmemcheck in the commit message and use an appropriate 
Reported-by line as well. Thanks,

	Ingo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/