linux-kernel - Re: [PATCH] thinkpad-acpi: Avoid heap buffer overrun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20090721155038.GB22182@khazad-dum.debian.net>
Date:	Tue, 21 Jul 2009 12:50:38 -0300
From:	Henrique de Moraes Holschuh <hmh@....eng.br>
To:	Michael Buesch <mb@...sch.de>
Cc:	ibm-acpi-devel@...ts.sourceforge.net, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] thinkpad-acpi: Avoid heap buffer overrun

On Tue, 21 Jul 2009, Michael Buesch wrote:
> Avoid a heap buffer overrun triggered by an integer overflow of the userspace
> controlled "count" variable.
> If userspace passes in a "count" of (size_t)-1l, the kmalloc size will overflow
> to ((size_t)-1l + 2) = 1, so only one byte will be allocated. However, copy_from_user()
> will attempt to copy 0xFFFFFFFF (or 0xFFFFFFFFFFFFFFFF on 64bit) bytes to the buffer.

Good catch.  Thank you!

Patch acked, and queued.  I am sending it to Len Brown now (although I think
he is taking his post-rc2 time off, so it might take a week or so for it to
be sent to Linus).

It is a security hole alright, and while it is NOT open in a default
configuration, it CAN be used for local priviledge escalation on any system
where the distro or the local administratior used chown() or chmod() to
unrestrict access to /proc/acpi/ibm/*.

The code in question is in mainline since 2.6.12, and maybe even earlier.
Argh.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/