linux-kernel - Re: [PATCH] binfmt_misc.c: avoid potential kernel stack overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20080818144418.GA4818@localhost.localdomain>
Date:	Mon, 18 Aug 2008 17:44:19 +0300
From:	"Kirill A. Shutemov" <kirill@...temov.name>
To:	Pavel Emelyanov <xemul@...nvz.org>
Cc:	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>
Subject: Re: [PATCH] binfmt_misc.c: avoid potential kernel stack overflow

On Mon, Aug 18, 2008 at 06:09:23PM +0400, Pavel Emelyanov wrote:
> (Put lkml in Cc. The original message is beyond)
> 
> Oops! My fault. The problem is that in case of modularized binfmt,
> the appropriate binary handler gets registered _before_ the script
> one and sets the misc_bang flag even too early.
> 
> Thus when we launch a script the load_misc_binary sets this bang,
> then returns error, since the binary is actually a script, then the
> load_script_binary successfully loads the script, then it loads the
> misc binary again, which exits with the -ENOEXEC error due to bang 
> set.
> 
> This patch helped my box, what about yours?

It works. Thank you.

Reported-and-tested-by: Kirill A. Shutemov <kirill@...temov.name>

I have noticed yet another problem: more than one bit of sh_bang can be
used on alpha:

fs/exec.c
1189                         return retval;
1190 
1191                 /* Remember if the application is TASO.  */
1192                 bprm->sh_bang = eh->ah.entry < 0x100000000UL;
1193 
1194                 bprm->file = file;


-- 
Regards,  Kirill A. Shutemov
 + Belarus, Minsk
 + ALT Linux Team, http://www.altlinux.com/

Download attachment "signature.asc" of type "application/pgp-signature" (198 bytes)