linux-kernel - Re: [PATCH] prctl: fix PR_SET_MM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210315102901.GP21246@kadam>
Date:   Mon, 15 Mar 2021 13:29:02 +0300
From:   Dan Carpenter <dan.carpenter@...cle.com>
To:     Alexey Dobriyan <adobriyan@...il.com>
Cc:     akpm@...ux-foundation.org, linux-kernel@...r.kernel.org,
        gorcunov@...nvz.org, security@...nel.org
Subject: Re: [PATCH] prctl: fix PR_SET_MM_AUXV kernel stack leak

On Sun, Mar 14, 2021 at 11:51:14PM +0300, Alexey Dobriyan wrote:
> 	prctl(PR_SET_MM, PR_SET_MM_AUXV, addr, 1);
> 
> will copy 1 byte from userspace to (quite big) on-stack array
> and then stash everything to mm->saved_auxv.

What?  It won't save everything, only the 1 byte.  What am I not seeing?

kernel/sys.c
  2073  static int prctl_set_auxv(struct mm_struct *mm, unsigned long addr,
  2074                            unsigned long len)
  2075  {
  2076          /*
  2077           * This doesn't move the auxiliary vector itself since it's pinned to
  2078           * mm_struct, but it permits filling the vector with new values.  It's
  2079           * up to the caller to provide sane values here, otherwise userspace
  2080           * tools which use this vector might be unhappy.
  2081           */
  2082          unsigned long user_auxv[AT_VECTOR_SIZE] = {};
  2083  
  2084          if (len > sizeof(user_auxv))
  2085                  return -EINVAL;
  2086  
  2087          if (copy_from_user(user_auxv, (const void __user *)addr, len))
                                   ^^^^^^^^^                             ^^^
Copies one byte from user space.

  2088                  return -EFAULT;
  2089  
  2090          /* Make sure the last entry is always AT_NULL */
  2091          user_auxv[AT_VECTOR_SIZE - 2] = 0;
  2092          user_auxv[AT_VECTOR_SIZE - 1] = 0;
  2093  
  2094          BUILD_BUG_ON(sizeof(user_auxv) != sizeof(mm->saved_auxv));
  2095  
  2096          task_lock(current);
  2097          memcpy(mm->saved_auxv, user_auxv, len);
                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Saves one byte to mm->saved_auxv.

  2098          task_unlock(current);
  2099  
  2100          return 0;
  2101  }

regards,
dan carpenter