linux-kernel - [PATCH] initramfs: handle unrecognised decompressor when unpacking

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:	Fri, 23 Apr 2010 04:02:29 +0100
From:	Phillip Lougher <phillip@...gher.demon.co.uk>
To:	Linux Kernel Development <linux-kernel@...r.kernel.org>
CC:	Andrew Morton <akpm@...ux-foundation.org>,
	Aaro Koskinen <aaro.koskinen@....fi>,
	hsweeten@...ionengravers.com, "H. Peter Anvin" <hpa@...or.com>,
	eric.piel@...mplin-utc.net, stable <stable@...nel.org>
Subject: [PATCH] initramfs: handle unrecognised decompressor when unpacking

The unpack routine fails to handle the decompress_method() returning
unrecognised decompressor (compress_name == NULL).  This results in
the routine looping eventually oopsing on an out of bounds memory
access.

Note this bug is usually hidden, only triggering on trailing
junk after one or more correct compressed blocks.  The
case of the compressed archive being complete junk
is (by accident?) caught by the if (state != Reset) check
because state is initialised to Start, but not updated due to
the decompressor not having been called.   Obviously if the junk
is trailing a correctly decompressed buffer, state == Reset from the
previous call to the decompressor.

Reported-by: Aaro Koskinen <aaro.koskinen@....fi>
Signed-off-by: Phillip Lougher <phillip@...gher.demon.co.uk>
---
  init/initramfs.c |    3 ++-
  1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/init/initramfs.c b/init/initramfs.c
index 37d3859..4b9c202 100644
--- a/init/initramfs.c
+++ b/init/initramfs.c
@@ -457,7 +457,8 @@ static char * __init unpack_to_rootfs(char *buf, unsigned len)
  					 compress_name);
  				message = msg_buf;
  			}
-		}
+		} else
+			error("junk in compressed archive");
  		if (state != Reset)
  			error("junk in compressed archive");
  		this_header = saved_offset + my_inptr;
-- 
1.6.3.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/