linux-kernel - Re: CVE-2009-2584

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <alpine.LRH.2.00.0911051620510.31913@twin.jikos.cz>
Date:	Thu, 5 Nov 2009 16:27:23 +0100 (CET)
From:	Jiri Kosina <jkosina@...e.cz>
To:	Michael Gilbert <michael.s.gilbert@...il.com>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	Michael Buesch <mb@...sch.de>, Jack Steiner <steiner@....com>
Cc:	linux-kernel@...r.kernel.org, stable@...nel.org
Subject: Re: CVE-2009-2584


[ adding some more CCs and including patch below for completness, 
  obviously it got lost in space ]

On Wed, 4 Nov 2009, Michael Gilbert wrote:

> CVE-2009-2584 [0],[1] has been disclosed for quite a while now (with 
> existing exploit code by Brad Spengler [2]).  A patch has also been 
> available for the same amount of time [3], but as of 2.6.32-rc6 it is 
> still not applied.  Did this slip through the cracks?  Thanks upfront 
> for any info on the matter.
[ ... ]
> [0] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2584
> [1] http://xorl.wordpress.com/2009/07/21/linux-kernel-sgi-gru-driver-off-by-one-overwrite/
> [2] http://grsecurity.net/~spender/exploit_demo.c
> [3] http://lkml.org/lkml/2009/7/20/348



From: Michael Buesch <mb@...sch.de>
Subject: sgi-gru: Fix kernel stack buffer overrun

This patch fixes a kernel stack buffer overrun in the sgi-gru procfs 
interface implementation. The "count" parameter to options_write() is user 
controlled. So this bug can be used to write '\0' bytes to almost 
arbitrary places on the kernel stack.

Cc: stable@...nel.org
Signed-off-by: Michael Buesch <mb@...sch.de>
Acked-by: Jack Steiner <steiner@....com>

--- linux-2.6.orig/drivers/misc/sgi-gru/gruprocfs.c
+++ linux-2.6/drivers/misc/sgi-gru/gruprocfs.c
@@ -157,23 +157,23 @@ static int options_show(struct seq_file 
 	seq_printf(s, "0x%lx\n", gru_options);
 	return 0;
 }
 
 static ssize_t options_write(struct file *file, const char __user *userbuf,
 			     size_t count, loff_t *data)
 {
 	unsigned long val;
 	char buf[80];
 
+	memset(buf, 0, sizeof(buf));
 	if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0)
 		return -EFAULT;
-	buf[count - 1] = '\0';
 	if (!strict_strtoul(buf, 10, &val))
 		gru_options = val;
 
 	return count;
 }
 
 static int cch_seq_show(struct seq_file *file, void *data)
 {
 	long gid = *(long *)data;
 	int i;

  
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/