linux-kernel - Re: Wrong length / buffer overlow by the syslog syscall

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 5 Dec 2012 12:26:09 +0100
From:	Sylvain Munaut <s.munaut@...tever-company.com>
To:	linux-kernel@...r.kernel.org
Cc:	Jeff Mahoney <jeffm@...e.com>
Subject: Re: Wrong length / buffer overlow by the syslog syscall

Hi,

> It happens on several machines and this only seem to happen if there
> was a wrap around in the log buffer (it's a first observation on a
> limited number of sample so it might be a coincidence)

I think the culprit is print_time and has nothing to do with wrap
around, just the uptime.

static size_t print_time(u64 ts, char *buf)
{
       unsigned long rem_nsec;

       if (!printk_time)
               return 0;

       if (!buf)
               return 15;

       rem_nsec = do_div(ts, 1000000000);
       return sprintf(buf, "[%5lu.%06lu] ",
                      (unsigned long)ts, rem_nsec / 1000);
}

it assumes the time will always be 15 char which is wrong. The %5lu
only guarantees a _minimum_ length of 5 chars, but if ts is large
enough it can be 6,7,...
and indeed in my logs I see "[601678.426219] "  which is 16 chars
(includes the space at the end).

Cheers,

     Sylvain
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/