linux-kernel - Re: [PATCH] Fixing returning a userspace address for return value

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <7df6e94f-a4c7-d181-7f9a-165e95b493@namei.org>
Date:   Wed, 20 Oct 2021 05:41:21 +1100 (AEDT)
From:   James Morris <jmorris@...ei.org>
To:     "T. Williams" <tdwilliamsiv@...il.com>,
        Casey Schaufler <casey@...aufler-ca.com>
cc:     "Serge E. Hallyn" <serge@...lyn.com>,
        linux-security-module@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Fixing returning a userspace address for return value

On Tue, 19 Oct 2021, T. Williams wrote:

> Fixing user memory dereference bug.
> 
> Signed-off-by: Thelford Williams <tdwilliamsiv@...il.com>

Casey, can you check the logic on this?

> ---
>  security/security.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/security/security.c b/security/security.c
> index 9ffa9e9c5c55..7c41b5d732ab 100644
> --- a/security/security.c
> +++ b/security/security.c
> @@ -1737,6 +1737,8 @@ int security_kernel_read_file(struct file *file, enum
> kernel_read_file_id id,
>         int ret;
> 
>         ret = call_int_hook(kernel_read_file, 0, file, id, contents);
> +       if (ret > 0)
> +               return -EINVAL;
>         if (ret)
>                 return ret;
>         return ima_read_file(file, id, contents);
> -- 
> 2.25.1
> 
> This commit is to fix a userspace address dereference found by
> syzkaller.
> The crash is triggered by passing a file descriptor to an incorrectly
> formed kernel module to finit_module.
> 
> Kernel/module.c:4175 : Within the finit_module, info.len is set to the
> return value from kernel_read_file_from_fd. This value is then
> dereferenced by memcmp within module_sig_check from inside load_module.
> The value is 0xb000000 so the kernel dereferences user memory and kernel
> panics.
> 
> To prevent this adding a check from within security_kernel_read_file to
> make sure call_int_hook doesn't return an address which in the syzkaller
> program is what causes the return value to be 0xb000000. Then the return
> value of security_kernel_read_file is returned to kernel_read_file(also
> in security/security.c) which returns the value to
> kernel_read_file_from_fd (fs/kernel_read_file.c) and this returns the
> value into err then being set to info.len causing the dereference when
> info is passed into load_module.
> 

-- 
James Morris
<jmorris@...ei.org>