lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sat, 16 Sep 2017 21:18:56 +0300 From: Konstantin Khlebnikov <khlebnikov@...dex-team.ru> To: linux-kernel <linux-kernel@...r.kernel.org> Cc: Serge Hallyn <serge@...lyn.com>, James Morris <james.l.morris@...cle.com>, LSM List <linux-security-module@...r.kernel.org> Subject: [BUG] security_release_secctx seems broken I've got this kmemleak splat unreferenced object 0xffff880f687ff6a8 (size 32): comm "cp", pid 4279, jiffies 4295784487 (age 2866.296s) hex dump (first 32 bytes): 01 00 00 02 02 00 08 00 00 00 00 00 00 00 00 00 ................ 00 00 00 00 00 6b 6b 6b 6b 6b 6b 6b 6b 6b 6b a5 .....kkkkkkkkkk. backtrace: [<ffffffff8192d77a>] kmemleak_alloc+0x4a/0xa0 [<ffffffff8125b721>] __kmalloc_track_caller+0x171/0x280 [<ffffffff812125c7>] krealloc+0xa7/0xc0 [<ffffffff812abb2d>] vfs_getxattr_alloc+0xbd/0x110 [<ffffffff813ba789>] cap_inode_getsecurity+0x79/0x200 [<ffffffff813be4d2>] security_inode_getsecurity+0x52/0x80 [<ffffffff812aad1a>] xattr_getsecurity+0x3a/0xa0 [<ffffffff812aadf4>] vfs_getxattr+0x74/0xa0 [<ffffffff812ab27e>] getxattr+0x9e/0x170 [<ffffffff812abd2a>] SyS_fgetxattr+0x5a/0x90 [<ffffffff8193a67b>] entry_SYSCALL_64_fastpath+0x1e/0xae [<ffffffffffffffff>] 0xffffffffffffffff allocated in xattr_getsecurity() security_inode_getsecurity() -> cap_inode_getsecurity() should be freed by security_release_secctx() but there is no release_secctx hook. I don't know details about modern security models stack but it seems security_release_secctx() have to know which layer owns secdata to free it property: selinux just calls kfree, capability_hooks should do the same, but other modules returns non-freeable pointers. Currently security_release_secctx() calls release_secctx for all models, this is obviously wrong.
Powered by blists - more mailing lists