linux-kernel - [PATCH] sysctl: Check name array length in deprecated_sysctl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 24 May 2017 14:21:39 +0200
From:   Mateusz Jurczyk <mjurczyk@...gle.com>
To:     "David S. Miller" <davem@...emloft.net>,
        Matthew Whitehead <tedheadster@...il.com>,
        "Eric W. Biederman" <ebiederm@...ssion.com>,
        Tetsuo Handa <penguin-kernel@...ove.SAKURA.ne.jp>,
        Andrew Morton <akpm@...ux-foundation.org>
Cc:     linux-kernel@...r.kernel.org
Subject: [PATCH] sysctl: Check name array length in deprecated_sysctl_warning()

Prevent use of uninitialized memory (originating from the stack frame of
do_sysctl()) by verifying that the name array is filled with sufficient
input data before comparing its specific entries with integer constants.

Through timing measurement or analyzing the kernel debug logs, a user-mode
program could potentially infer the results of comparisons against the
uninitialized memory, and acquire some (very limited) information about the
state of the kernel stack. The change also eliminates possible future
warnings by tools such as KMSAN and other code checkers /
instrumentations.

Signed-off-by: Mateusz Jurczyk <mjurczyk@...gle.com>
---
 kernel/sysctl_binary.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c
index ece4b177052b..38d6ba22a209 100644
--- a/kernel/sysctl_binary.c
+++ b/kernel/sysctl_binary.c
@@ -1346,7 +1346,7 @@ static void deprecated_sysctl_warning(const int *name, int nlen)
 	 * CTL_KERN/KERN_VERSION is used by older glibc and cannot
 	 * ever go away.
 	 */
-	if (name[0] == CTL_KERN && name[1] == KERN_VERSION)
+	if (nlen >= 2 && name[0] == CTL_KERN && name[1] == KERN_VERSION)
 		return;

 	if (printk_ratelimit()) {
-- 
2.13.0.219.gdb65acc882-goog