linux-kernel - [PATCH] proc: Fix uninitialized byte read in get_mm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190712160913.17727-1-izbyshev@ispras.ru>
Date:   Fri, 12 Jul 2019 19:09:13 +0300
From:   Alexey Izbyshev <izbyshev@...ras.ru>
To:     Alexey Dobriyan <adobriyan@...il.com>
Cc:     linux-kernel@...r.kernel.org, linux-fsdevel@...r.kernel.org,
        security@...nel.org, Alexey Izbyshev <izbyshev@...ras.ru>,
        Oleg Nesterov <oleg@...hat.com>
Subject: [PATCH] proc: Fix uninitialized byte read in get_mm_cmdline()

get_mm_cmdline() leaks an uninitialized byte located at
user-controlled offset in a newly-allocated kernel page in
the following scenario.

- When reading the last chunk of cmdline, access_remote_vm()
  fails to copy the requested number of bytes, but still copies
  enough bytes so that we get into the body of
  "if (pos + got >= arg_end)" statement. This can be arranged by user,
  for example, by applying mprotect(PROT_NONE) to the env block.

- strnlen() doesn't find a NUL byte. This too can be arranged
  by user via suitable modifications of argument and env blocks.

- The above causes the following condition to be true despite
  that no NUL byte was found:

	/* Include the NUL if it existed */
	if (got < size)
		got++;

The resulting increment causes the subsequent copy_to_user()
to copy an extra byte from "page" to userspace. That byte might
come from previous uses of memory referred by "page" before
it was allocated by get_mm_cmdline(), potentially leaking
data belonging to other processes or kernel.

Fix this by ensuring that "size + offset" doesn't exceed the number
of bytes copied by access_remote_vm().

Fixes: f5b65348fd77 ("proc: fix missing final NUL in get_mm_cmdline() rewrite")
Cc: Alexey Dobriyan <adobriyan@...il.com>
Cc: Oleg Nesterov <oleg@...hat.com>
Signed-off-by: Alexey Izbyshev <izbyshev@...ras.ru>
---

This patch was initially sent to <security@...nel.org> accompanied
with a little program that exploits the bug to dump the kernel page
used in get_mm_cmdline().

Thanks to Oleg Nesterov and Laura Abbott for their feedback!

 fs/proc/base.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/fs/proc/base.c b/fs/proc/base.c
index 255f6754c70d..6e30dd791761 100644
--- a/fs/proc/base.c
+++ b/fs/proc/base.c
@@ -275,6 +275,8 @@ static ssize_t get_mm_cmdline(struct mm_struct *mm, char __user *buf,
 		if (got <= offset)
 			break;
 		got -= offset;
+		if (got < size)
+			size = got;

 		/* Don't walk past a NUL character once you hit arg_end */
 		if (pos + got >= arg_end) {
-- 
2.21.0