lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Fri, 10 Jan 2014 04:34:12 +0000 (UTC) From: Mathieu Desnoyers <mathieu.desnoyers@...icios.com> To: Rusty Russell <rusty@...tcorp.com.au> Cc: Anton Blanchard <anton@...ba.org>, Benjamin Herrenschmidt <benh@...nel.crashing.org>, Linux Kernel Mailing List <linux-kernel@...r.kernel.org> Subject: powerpc: possible access beyond TASK_SIZE in start_thread Hi Rusty, I was looking at the diff between kernel v3.12 and recent master (after 3.13-rc7), and noticed that in the following commit: commit 94af3abf995b17f6a008b00152c94841242ec6c7 Author: Rusty Russell <rusty@...tcorp.com.au> Date: Wed Nov 20 22:15:02 2013 +1100 powerpc: ELF2 binaries launched directly. on powerpc, those lines appear in start_thread(): + /* start is a relocated pointer to the function + * descriptor for the elf _start routine. The first + * entry in the function descriptor is the entry + * address of _start and the second entry is the TOC + * value we need to use. + */ + __get_user(entry, (unsigned long __user *)start); + __get_user(toc, (unsigned long __user *)start+1); Note the "__" before get_user(), which bypass any kind of validation on the addresses. Amongst the callers, if we look at fs/binfmt_elf.c:load_elf_binary(), we see: elf_entry = loc->elf_ex.e_entry; if (BAD_ADDR(elf_entry)) { force_sig(SIGSEGV, current); retval = -EINVAL; goto out_free_dentry; } and the elf_entry gets passed to start_thread(). If we craft a binary with elf_entry address of TASK_SIZE - 1 (1 byte before TASK_SIZE), then I think we could make both __get_user() calls access data beyond TASK_SIZE, because elf_entry address is verified, but there is no validation on its range AFAIU. Is it expected ? Am I missing something ? Thanks, Mathieu -- Mathieu Desnoyers EfficiOS Inc. http://www.efficios.com -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists