linux-kernel - powerpc: possible access beyond TASK_SIZE in start

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <40484806.5780.1389328452206.JavaMail.zimbra@efficios.com>
Date:	Fri, 10 Jan 2014 04:34:12 +0000 (UTC)
From:	Mathieu Desnoyers <mathieu.desnoyers@...icios.com>
To:	Rusty Russell <rusty@...tcorp.com.au>
Cc:	Anton Blanchard <anton@...ba.org>,
	Benjamin Herrenschmidt <benh@...nel.crashing.org>,
	Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: powerpc: possible access beyond TASK_SIZE in start_thread

Hi Rusty,

I was looking at the diff between kernel v3.12 and recent master (after 3.13-rc7),
and noticed that in the following commit:

commit 94af3abf995b17f6a008b00152c94841242ec6c7
Author: Rusty Russell <rusty@...tcorp.com.au>
Date:   Wed Nov 20 22:15:02 2013 +1100

    powerpc: ELF2 binaries launched directly.

on powerpc, those lines appear in start_thread():

+                       /* start is a relocated pointer to the function
+                        * descriptor for the elf _start routine.  The first
+                        * entry in the function descriptor is the entry
+                        * address of _start and the second entry is the TOC
+                        * value we need to use.
+                        */
+                       __get_user(entry, (unsigned long __user *)start);
+                       __get_user(toc, (unsigned long __user *)start+1);

Note the "__" before get_user(), which bypass any kind of validation on the
addresses.

Amongst the callers, if we look at fs/binfmt_elf.c:load_elf_binary(), we see:

                elf_entry = loc->elf_ex.e_entry;
                if (BAD_ADDR(elf_entry)) {
                        force_sig(SIGSEGV, current);
                        retval = -EINVAL;
                        goto out_free_dentry;
                }

and the elf_entry gets passed to start_thread().

If we craft a binary with elf_entry address of

TASK_SIZE - 1  (1 byte before TASK_SIZE), then I think we could make both
__get_user() calls access data beyond TASK_SIZE, because elf_entry address
is verified, but there is no validation on its range AFAIU. Is it expected ?
Am I missing something ?

Thanks,

Mathieu


-- 
Mathieu Desnoyers
EfficiOS Inc.
http://www.efficios.com
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/