linux-kernel - [PATCH] x86/module: Fixed bug allowing invalid relocation addresses.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sat, 14 Mar 2020 23:36:26 +0200
From:   Gilad Wharton Kleinman <dkgs1998@...il.com>
To:     Thomas Gleixner <tglx@...utronix.de>,
        Ingo Molnar <mingo@...hat.com>, Borislav Petkov <bp@...en8.de>,
        "H. Peter Anvin" <hpa@...or.com>, x86@...nel.org
Cc:     Gilad Wharton Kleinman <dkgs1998@...il.com>,
        linux-kernel@...r.kernel.org
Subject: [PATCH] x86/module: Fixed bug allowing invalid relocation addresses.

If a kernel module with a bad relocation offset is loaded to a x86 kernel,
the kernel will apply the relocation to a address not inside the module
(resulting in memory in the kernel being overridden).

Signed-off-by: Gilad Wharton Kleinman <dkgs1998@...il.com>
---
 arch/x86/kernel/module.c | 57 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 53 insertions(+), 4 deletions(-)

diff --git a/arch/x86/kernel/module.c b/arch/x86/kernel/module.c
index d5c72cb877b3..0929b614b62a 100644
--- a/arch/x86/kernel/module.c
+++ b/arch/x86/kernel/module.c
@@ -96,10 +96,19 @@ int apply_relocate(Elf32_Shdr *sechdrs,
 	Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
 	Elf32_Sym *sym;
 	uint32_t *location;
+	Elf32_Word section_size;
 
 	DEBUGP("Applying relocate section %u to %u\n",
 	       relsec, sechdrs[relsec].sh_info);
 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
+
+		section_size = sechdrs[sechdrs[relsec].sh_info].sh_size;
+		if (section_size < rel[i].r_offset + sizeof(u32)) {
+			pr_err("%s: Relocation offset %u is not in section (section len %u)\n",
+				me->name, rel[i].r_offset, section_size);
+			return -ENOEXEC;
+		}
+
 		/* This is where to make the change */
 		location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
 			+ rel[i].r_offset;
@@ -126,6 +135,47 @@ int apply_relocate(Elf32_Shdr *sechdrs,
 	return 0;
 }
 #else /*X86_64*/
+
+bool is_reloc_addr_valid(Elf64_Shdr *sechdrs,
+			unsigned int relsec,
+			Elf64_Rela rel,
+			struct module *me)
+{
+	unsigned int rel_size;
+	Elf64_Xword section_size = sechdrs[sechdrs[relsec].sh_info].sh_size;
+
+	switch (ELF64_R_TYPE(rel.r_info)) {
+	case R_X86_64_NONE:
+		return true;
+
+	case R_X86_64_64:
+	case R_X86_64_PC64:
+		rel_size = sizeof(u64);
+		break;
+
+	case R_X86_64_32:
+	case R_X86_64_32S:
+	case R_X86_64_PC32:
+	case R_X86_64_PLT32:
+		rel_size = sizeof(u32);
+		break;
+
+	default:
+		pr_err("%s: Unknown rela relocation: %llu\n",
+				me->name, ELF64_R_TYPE(rel.r_info));
+		return false;
+	}
+
+	if (section_size < rel.r_offset + rel_size) {
+		pr_err("%s: Relocation offset %llu and of length %u, is not in section (section len %llu)\n",
+			me->name, rel.r_offset,
+			rel_size, section_size);
+		return false;
+	}
+
+	return true;
+}
+
 int apply_relocate_add(Elf64_Shdr *sechdrs,
 		   const char *strtab,
 		   unsigned int symindex,
@@ -141,6 +191,9 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
 	DEBUGP("Applying relocate section %u to %u\n",
 	       relsec, sechdrs[relsec].sh_info);
 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
+		if (!is_reloc_addr_valid(sechdrs, relsec, rel[i], me))
+			return -ENOEXEC;
+
 		/* This is where to make the change */
 		loc = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
 			+ rel[i].r_offset;
@@ -195,10 +248,6 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
 			val -= (u64)loc;
 			*(u64 *)loc = val;
 			break;
-		default:
-			pr_err("%s: Unknown rela relocation: %llu\n",
-			       me->name, ELF64_R_TYPE(rel[i].r_info));
-			return -ENOEXEC;
 		}
 	}
 	return 0;
-- 
2.17.1