lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20180516131108.xcvsw6m4qrmqgykh@mwanda>
Date:   Wed, 16 May 2018 16:11:08 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Mauro Carvalho Chehab <mchehab+samsung@...nel.org>
Cc:     "Gustavo A. R. Silva" <gustavo@...eddedor.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        linux-media@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 01/11] media: tm6000: fix potential Spectre variant 1

On Tue, May 15, 2018 at 04:00:33PM -0300, Mauro Carvalho Chehab wrote:
> Yeah, that's the same I'm getting from media upstream.
> 
> > drivers/media/cec/cec-pin-error-inj.c:170 cec_pin_error_inj_parse_line() 
> > warn: potential spectre issue 'pin->error_inj_args'
> 
> This one seems a false positive, as the index var is u8 and the
> array has 256 elements, as the userspace input from 'op' is 
> initialized with:
> 
> 	u8 v;
> 	u32 op;
> 
> 	if (!kstrtou8(token, 0, &v))
> 		op = v;
> 

It's hard to silence this because Smatch stores the current user
controlled range list, not what it was initially.  I wrote all this code
to detect bounds checking errors, so there wasn't any need to save the
range list before the bounds check.  Since "op" is a u32, I can't even
go by the type of the index....

> > drivers/media/dvb-core/dvb_ca_en50221.c:1479 dvb_ca_en50221_io_write() 
> > warn: potential spectre issue 'ca->slot_info' (local cap)
> 
> This one seems a real issue to me. Sent a patch for it.
> 
> > drivers/media/dvb-core/dvb_net.c:252 handle_one_ule_extension() warn: 
> > potential spectre issue 'p->ule_next_hdr'
> 
> I failed to see what's wrong here, or if this is exploited. 

Oh...  Huh.  This is a bug in smatch.  That line looks like:

	p->ule_sndu_type = ntohs(*(__be16 *)(p->ule_next_hdr + ((p->ule_dbit ? 2 : 3) * ETH_ALEN)));

Smatch see the ntohs() and marks everything inside it as untrusted
network data.  I'll fix this.

regards,
dan carpenter

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ