linux-kernel - [PATCH] s390/qeth: fix a missing-check bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <1538842104-26018-1-git-send-email-wang6495@umn.edu>
Date:   Sat,  6 Oct 2018 11:08:23 -0500
From:   Wenwen Wang <wang6495@....edu>
To:     Wenwen Wang <wang6495@....edu>
Cc:     Kangjie Lu <kjlu@....edu>, Julian Wiedmann <jwi@...ux.ibm.com>,
        Ursula Braun <ubraun@...ux.ibm.com>,
        Martin Schwidefsky <schwidefsky@...ibm.com>,
        Heiko Carstens <heiko.carstens@...ibm.com>,
        linux-s390@...r.kernel.org (open list:S390 NETWORK DRIVERS),
        linux-kernel@...r.kernel.org (open list)
Subject: [PATCH] s390/qeth: fix a missing-check bug

In qeth_snmp_command(), the length of the user request is firstly copied
from the user-space buffer 'udata' to the kernel variable 'req_len' and
checked to see whether it is too large. If the check fails, an error code
EINVAL is returned. Otherwise, the execution continues and the whole buffer
is copied again from 'udata' and saved to the kernel buffer 'ureq'.
However, after the second copy, no re-check is enforced on the newly-copied
request length. Given that the buffer 'udata' is in the user space, a
malicious user can race to change the request length between the two
copies. In this way, the attacker can supply malicious data to the kernel
and cause undefined behavior.

This patch adds a re-check on the request length after the second copy from
the buffer 'udata'. If the newly-copied value is different from the value
obtained in the first copy, i.e., 'req_len', an error code EINVAL will be
returned after the buffer 'ureq' is freed.

Signed-off-by: Wenwen Wang <wang6495@....edu>
---
 drivers/s390/net/qeth_core_main.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
index de82824..6199743 100644
--- a/drivers/s390/net/qeth_core_main.c
+++ b/drivers/s390/net/qeth_core_main.c
@@ -4613,6 +4613,10 @@ static int qeth_snmp_command(struct qeth_card *card, char __user *udata)
 		QETH_CARD_TEXT(card, 2, "snmpnome");
 		return PTR_ERR(ureq);
 	}
+	if (ureq->hdr.req_len != req_len) {
+		kfree(ureq);
+		return -EINVAL;
+	}
 	qinfo.udata_len = ureq->hdr.data_len;
 	qinfo.udata = kzalloc(qinfo.udata_len, GFP_KERNEL);
 	if (!qinfo.udata) {
-- 
2.7.4