linux-hardening - Re: Potentially interesting memcpy/memset/memmove calls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <1517972876.806883.1629141069696@privateemail.com>
Date:   Mon, 16 Aug 2021 15:11:09 -0400 (EDT)
From:   Jordy Zomer <jordy@...ing.systems>
To:     "linux-hardening@...r.kernel.org" <linux-hardening@...r.kernel.org>
Cc:     "keescook@...omium.org" <keescook@...omium.org>
Subject: Re: Potentially interesting memcpy/memset/memmove calls

Hi There!

I just re-ran the query and added a check to see whether the size argument of those functions isn't a constant; this should eliminate a lot of false positives. The amended list with fewer results can be found below (still ran on the same database).

URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/fpu/core.c?h=v5.13.11#n229
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n500
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n528
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n536
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c?h=v5.13.11#n74
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/w1/w1_netlink.c?h=v5.13.11#n614
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7007
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7011
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n1037
URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n831

Best Regards,

Jordy Zomer

> On 08/16/2021 12:27 PM Jordy Zomer <jordy@...ing.systems> wrote:
> 
>  
> Hiya!
> 
> Kees asked me to develop a query to detect calls where the destinations could need some attention as part of his initiative to harden memcpy calls.
> 
> Regarding:
> (https://lore.kernel.org/lkml/20210727205855.411487-1-keescook@chromium.org/)
> 
> As a result, I created a CodeQL query to detect some questionable instances. This query identifies a struct having a flexible array member when it is supplied as a reference to memcpy/memmove/memset's first argument. The query was performed on 5.13.11.
> I'm now compiling a database with `make allmodconfig` to see if it finds anything else, but you can see the preliminary findings below.
> 
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kernel/fpu/core.c?h=v5.13.11#n229
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/arch/x86/kvm/x86.c?h=v5.13.11#n10972
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n500
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n528
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/infiniband/hw/i40iw/i40iw_virtchnl.c?h=v5.13.11#n536
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/message/fusion/mptbase.c?h=v5.13.11#n1854
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/arcnet/arcnet.c?h=v5.13.11#n1145
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/ethernet/mellanox/mlxsw/spectrum_acl_tcam.c?h=v5.13.11#n336
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/net/wireless/intel/iwlwifi/iwl-dbg-tlv.c?h=v5.13.11#n74
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/sony-laptop.c?h=v5.13.11#n4529
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/platform/x86/sony-laptop.c?h=v5.13.11#n4548
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/scsi/be2iscsi/be_mgmt.c?h=v5.13.11#n865
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/w1/w1_netlink.c?h=v5.13.11#n614
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/drivers/w1/w1_netlink.c?h=v5.13.11#n199
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7007
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/fs/ocfs2/alloc.c?h=v5.13.11#n7011
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/ethtool/ioctl.c?h=v5.13.11#n450
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/ipv4/devinet.c?h=v5.13.11#n262
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n1037
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/net/sched/cls_u32.c?h=v5.13.11#n831
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/virt/kvm/kvm_main.c?h=v5.13.11#n1506
> URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/virt/kvm/kvm_main.c?h=v5.13.11#n1522
> 
> 
> Best Regards,
> 
> Jordy Zomer