linux-kernel - auxv stuff (Re: [PATCH] prctl: fix PR_SET_MM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <YE734MgE40jTv9zJ@localhost.localdomain>
Date:   Mon, 15 Mar 2021 09:00:00 +0300
From:   Alexey Dobriyan <adobriyan@...il.com>
To:     Linus Torvalds <torvalds@...uxfoundation.org>
Cc:     Andrew Morton <akpm@...ux-foundation.org>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>,
        gorcunov@...nvz.org
Subject: auxv stuff (Re: [PATCH] prctl: fix PR_SET_MM_AUXV kernel stack leak)

On Sun, Mar 14, 2021 at 02:40:05PM -0700, Linus Torvalds wrote:
> [mm->saved_auxv]
> 
> That's a separate issue, and I can't find it in myself to care (and
> nobody has ever complained), but I thought I'd mention it.

There is another (non-security) one. Compat 32-bit process will report
2 longs too many:

00000000  20 00 00 00 40 85 f5 f7  21 00 00 00 00 80 f5 f7  | ...@...!.......|
00000010  10 00 00 00 ff fb 8b 0f  06 00 00 00 00 10 00 00  |................|
00000020  11 00 00 00 64 00 00 00  03 00 00 00 34 80 04 08  |....d.......4...|
00000030  04 00 00 00 20 00 00 00  05 00 00 00 08 00 00 00  |.... ...........|
00000040  07 00 00 00 00 90 f5 f7  08 00 00 00 00 00 00 00  |................|
00000050  09 00 00 00 25 83 04 08  0b 00 00 00 00 00 00 00  |....%...........|
00000060  0c 00 00 00 00 00 00 00  0d 00 00 00 00 00 00 00  |................|
00000070  0e 00 00 00 00 00 00 00  17 00 00 00 00 00 00 00  |................|
00000080  19 00 00 00 8b 27 99 ff  1a 00 00 00 02 00 00 00  |.....'..........|
00000090  1f 00 00 00 f0 2f 99 ff  0f 00 00 00 9b 27 99 ff  |...../.......'..|
000000a0  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  |................|
	  AT_NULL     AT_NULL	   ^^^^^^^^^^^^^^^^^^^^^^^
000000b0