linux-kernel - [PATCH] binfmt_elf: Don't clobber passed executable's file header

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <alpine.LFD.2.20.1509062059400.10227@eddie.linux-mips.org>
Date:	Sun, 6 Sep 2015 23:26:44 +0100 (BST)
From:	"Maciej W. Rozycki" <macro@...ux-mips.org>
To:	Al Viro <viro@...iv.linux.org.uk>
cc:	Ralf Baechle <ralf@...ux-mips.org>, linux-fsdevel@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] binfmt_elf: Don't clobber passed executable's file header

Do not clobber the buffer space passed from `search_binary_handler' and 
originally preloaded by `prepare_binprm' with the executable's file 
header by overwriting it with its interpreter's file header.  Instead 
keep the buffer space intact and directly use the data structure locally 
allocated for the interpreter's file header, fixing a bug introduced in 
2.1.14 with loadable module support (linux-mips.org commit beb11695 
[Import of Linux/MIPS 2.1.14], predating kernel.org repo's history).  
Adjust the amount of data read from the interpreter's file accordingly.

This was not an issue before loadable module support, because back then 
`load_elf_binary' was executed only once for a given ELF executable, 
whether the function succeeded or failed.

With loadable module support supported and enabled, upon a failure of 
`load_elf_binary' -- which may for example be caused by architecture 
code rejecting an executable due to a missing hardware feature requested 
in the file header -- a module load is attempted and then the function 
reexecuted by `search_binary_handler'.  With the executable's file 
header replaced with its interpreter's file header the executable can 
then be erroneously accepted in this subsequent attempt.

Signed-off-by: Maciej W. Rozycki <macro@...ux-mips.org>
---
Al,

 The bug (which has already reached its adulthood) was discovered with 
an upcoming MIPS feature which this fix is a prerequisite for.

 Please apply.

  Maciej

linux-load-elf-binary-interp-buf-fix.diff
Index: linux-org-test/fs/binfmt_elf.c
===================================================================
--- linux-org-test.orig/fs/binfmt_elf.c	2015-07-18 00:11:13.000000000 +0100
+++ linux-org-test/fs/binfmt_elf.c	2015-07-18 00:32:41.509841000 +0100
@@ -759,16 +759,16 @@ static int load_elf_binary(struct linux_
 			 */
 			would_dump(bprm, interpreter);

-			retval = kernel_read(interpreter, 0, bprm->buf,
-					     BINPRM_BUF_SIZE);
-			if (retval != BINPRM_BUF_SIZE) {
+			/* Get the exec headers */
+			retval = kernel_read(interpreter, 0,
+					     &loc->interp_elf_ex,
+					     sizeof(loc->interp_elf_ex));
+			if (retval != sizeof(loc->interp_elf_ex)) {
 				if (retval >= 0)
 					retval = -EIO;
 				goto out_free_dentry;
 			}

-			/* Get the exec headers */
-			loc->interp_elf_ex = *((struct elfhdr *)bprm->buf);
 			break;
 		}
 		elf_ppnt++;
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/