| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Thu, 12 Dec 2013 14:07:57 -0800 From: Kees Cook <keescook@...omium.org> To: linux-kernel@...r.kernel.org Cc: Andrew Morton <akpm@...ux-foundation.org>, Michel Lespinasse <walken@...gle.com>, Rik van Riel <riel@...hat.com>, Cyrill Gorcunov <gorcunov@...nvz.org>, Hugh Dickins <hughd@...gle.com>, linux-mm@...ck.org, PaX Team <pageexec@...email.hu>, Dmitry Vyukov <dvyukov@...gle.com> Subject: [PATCH] mm: fix use-after-free in sys_remap_file_pages From: PaX Team <pageexec@...email.hu> http://lkml.org/lkml/2013/9/17/30 SyS_remap_file_pages() calls mmap_region(), which calls remove_vma_list(), which calls remove_vma(), which frees the vma. Later (after out label) SyS_remap_file_pages() accesses the freed vma in vm_flags = vma->vm_flags. Reported-by: Dmitry Vyukov <dvyukov@...gle.com> Signed-off-by: PaX Team <pageexec@...email.hu> Signed-off-by: Kees Cook <keescook@...omium.org> Cc: stable@...r.kernel.org --- mm/fremap.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/mm/fremap.c b/mm/fremap.c index 5bff08147768..afad07b85ef2 100644 --- a/mm/fremap.c +++ b/mm/fremap.c @@ -218,6 +218,8 @@ get_write_lock: BUG_ON(addr != start); err = 0; } + vm_flags = vma->vm_flags; + vma = NULL; goto out; } mutex_lock(&mapping->i_mmap_mutex); -- 1.7.9.5 -- Kees Cook Chrome OS Security -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
Powered by blists - more mailing lists