linux-kernel - Re: [PATCH 1/1] x86: sanitize argument of clearcpuid command-line option

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20161229102105.GD11221@nazgul.tnic>
Date:   Thu, 29 Dec 2016 11:21:05 +0100
From:   Borislav Petkov <bp@...en8.de>
To:     Lukasz Odzioba <lukasz.odzioba@...el.com>
Cc:     linux-kernel@...r.kernel.org, tglx@...utronix.de, mingo@...hat.com,
        hpa@...or.com, x86@...nel.org, luto@...nel.org, slaoub@...il.com,
        bp@...e.de, dave.hansen@...ux.intel.com, andi.kleen@...el.com
Subject: Re: [PATCH 1/1] x86: sanitize argument of clearcpuid command-line
 option

On Wed, Dec 28, 2016 at 02:55:40PM +0100, Lukasz Odzioba wrote:
> A negative number can be specified in the cmdline which will be used as
> setup_clear_cpu_cap() argument. With that we can clear/set some bit in
> memory predceeding boot_cpu_data/cpu_caps_cleared which may cause kernel
> to misbehave. This patch adds lower bound check to setup_disablecpuid().
> 
> Fixes: ac72e7888a61 ("x86: add generic clearcpuid=... option")
> 
> Signed-off-by: Lukasz Odzioba <lukasz.odzioba@...el.com>
> ---
> As an example let's change definition of one_hundred variable:
> ffffffff81c4eeec d one_hundred
> ffffffff81d69720 D boot_cpu_data (0x14 is x86_capability offset)
> 
> 8*(0xffffffff81d69734-0xffffffff81c4eeec) => 9257536 -2 because we
> want to clear the second bit. With clearcpuid=-9257534 we change the
> definition of one_hundread to 96 which is used among other things
> as sysfs' max value for swappiness, so we can check the effect like so:
> # echo 96 >  /proc/sys/vm/swappiness
> # echo 97 >  /proc/sys/vm/swappiness
> -bash: echo: write error: Invalid argument
> ---
>  arch/x86/kernel/cpu/common.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
> index dc1697c..9bab7a8 100644
> --- a/arch/x86/kernel/cpu/common.c
> +++ b/arch/x86/kernel/cpu/common.c
> @@ -1221,7 +1221,7 @@ static __init int setup_disablecpuid(char *arg)
>  {
>  	int bit;
>  
> -	if (get_option(&arg, &bit) && bit < NCAPINTS*32)
> +	if (get_option(&arg, &bit) && bit >= 0 && bit < NCAPINTS * 32)
>  		setup_clear_cpu_cap(bit);
>  	else
>  		return 0;
> -- 

Yap, that's a good catch!

Acked-by: Borislav Petkov <bp@...e.de>

I even got a splat while experimenting with this:


[    1.234575] BUG: unable to handle kernel paging request at ffffffff858bd540
[    1.236535] IP: memcpy_erms+0x6/0x10
[    1.236535] PGD 1c10067 
[    1.236535] PUD 1c11063 
[    1.236535] PMD 0 
[    1.236535] 
[    1.236535] Oops: 0000 [#1] PREEMPT SMP
[    1.236535] Modules linked in:
[    1.236535] CPU: 1 PID: 1 Comm: swapper/0 Not tainted 4.10.0-rc1+ #8
[    1.236535] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
[    1.236535] task: ffff88007c3f8000 task.stack: ffffc9000031c000
[    1.236535] RIP: 0010:memcpy_erms+0x6/0x10
[    1.236535] RSP: 0000:ffffc9000031fd90 EFLAGS: 00010286
[    1.236535] RAX: ffff88007b94c600 RBX: 0000000000000180 RCX: 0000000000000180
[    1.236535] RDX: 0000000000000180 RSI: ffffffff858bd540 RDI: ffff88007b94c600
[    1.236535] RBP: ffffc9000031fda8 R08: ffff88007b94c600 R09: 0000000000000000
[    1.236535] R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff858bd540
[    1.236535] R13: ffffffff81cfa780 R14: ffffffff81cfa800 R15: 0000000000000000
[    1.236535] FS:  0000000000000000(0000) GS:ffff88007ed00000(0000) knlGS:0000000000000000
[    1.236535] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[    1.236535] CR2: ffffffff858bd540 CR3: 0000000001c0f000 CR4: 00000000001406e0
[    1.236535] Call Trace:
[    1.236535]  ? kmemdup+0x36/0x50
[    1.236535]  ip6_route_net_init+0xb1/0x1a5
[    1.236535]  ops_init.constprop.17+0x3e/0x160
[    1.236535]  register_pernet_operations+0x9a/0xd0
[    1.236535]  ? unix_diag_init+0x12/0x12
[    1.236535]  register_pernet_subsys+0x2a/0x40
[    1.236535]  ip6_route_init+0x7f/0x28b
[    1.236535]  ? unix_diag_init+0x12/0x12
[    1.236535]  inet6_init+0x18c/0x335
[    1.236535]  do_one_initcall+0x53/0x1a0
[    1.236535]  ? parse_args+0x260/0x3e0
[    1.236535]  kernel_init_freeable+0x11d/0x1a3
[    1.236535]  ? rest_init+0x140/0x140
[    1.236535]  kernel_init+0xe/0x100
[    1.236535]  ret_from_fork+0x27/0x40
[    1.236535] Code: c3 90 90 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 
[    1.236535] RIP: memcpy_erms+0x6/0x10 RSP: ffffc9000031fd90
[    1.236535] CR2: ffffffff858bd540
[    1.236535] ---[ end trace 1c01a71156422a06 ]---


-- 
Regards/Gruss,
    Boris.

ECO tip #101: Trim your mails when you reply.
--