linux-kernel - [PATCH] ext4: Don't leak old mountpoint samples

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20201201151301.22025-1-richard@nod.at>
Date:   Tue,  1 Dec 2020 16:13:01 +0100
From:   Richard Weinberger <richard@....at>
To:     tytso@....edu
Cc:     adilger.kernel@...ger.ca, linux-ext4@...r.kernel.org,
        linux-kernel@...r.kernel.org, Richard Weinberger <richard@....at>
Subject: [PATCH] ext4: Don't leak old mountpoint samples

As soon the first file is opened, ext4 samples the mountpoint
of the filesystem in 64 bytes of the super block.
It does so using strlcpy(), this means that the remaining bytes
in the super block string buffer are untouched.
If the mount point before had a longer path than the current one,
it can be reconstructed.

Consider the case where the fs was mounted to "/media/johnjdeveloper"
and later to "/".
The the super block buffer then contains "/\x00edia/johnjdeveloper".

This case was seen in the wild and caused confusion how the name
of a developer ands up on the super block of a filesystem used
in production...

Fix this by clearing the string buffer before writing to it,

Signed-off-by: Richard Weinberger <richard@....at>
---
 fs/ext4/file.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/fs/ext4/file.c b/fs/ext4/file.c
index 3ed8c048fb12..dba521250d01 100644
--- a/fs/ext4/file.c
+++ b/fs/ext4/file.c
@@ -809,6 +809,7 @@ static int ext4_sample_last_mounted(struct super_block *sb,
 	err = ext4_journal_get_write_access(handle, sbi->s_sbh);
 	if (err)
 		goto out_journal;
+	memset(sbi->s_es->s_last_mounted, 0x00, sizeof(sbi->s_es->s_last_mounted));
 	strlcpy(sbi->s_es->s_last_mounted, cp,
 		sizeof(sbi->s_es->s_last_mounted));
 	ext4_handle_dirty_super(handle, sb);
-- 
2.26.2