linux-kernel - Re: [PATCH AUTOSEL 6.1 34/35] prlimit: do_prlimit needs to have a speculation check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y8/5DKfHZ2Mj7m8Q@kroah.com>
Date:   Tue, 24 Jan 2023 16:28:12 +0100
From:   Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To:     Sasha Levin <sashal@...nel.org>
Cc:     linux-kernel@...r.kernel.org, stable@...r.kernel.org,
        Jordy Zomer <jordyzomer@...gle.com>,
        Linus Torvalds <torvalds@...uxfoundation.org>,
        ebiederm@...ssion.com, brho@...gle.com, catalin.marinas@....com,
        broonie@...nel.org, legion@...nel.org, Jason@...c4.com,
        surenb@...gle.com
Subject: Re: [PATCH AUTOSEL 6.1 34/35] prlimit: do_prlimit needs to have a
 speculation check

On Tue, Jan 24, 2023 at 08:41:30AM -0500, Sasha Levin wrote:
> From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> 
> [ Upstream commit 739790605705ddcf18f21782b9c99ad7d53a8c11 ]
> 
> do_prlimit() adds the user-controlled resource value to a pointer that
> will subsequently be dereferenced.  In order to help prevent this
> codepath from being used as a spectre "gadget" a barrier needs to be
> added after checking the range.
> 
> Reported-by: Jordy Zomer <jordyzomer@...gle.com>
> Tested-by: Jordy Zomer <jordyzomer@...gle.com>
> Suggested-by: Linus Torvalds <torvalds@...uxfoundation.org>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
> Signed-off-by: Sasha Levin <sashal@...nel.org>
> ---
>  kernel/sys.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/kernel/sys.c b/kernel/sys.c
> index 5fd54bf0e886..88b31f096fb2 100644
> --- a/kernel/sys.c
> +++ b/kernel/sys.c
> @@ -1442,6 +1442,8 @@ static int do_prlimit(struct task_struct *tsk, unsigned int resource,
>  
>  	if (resource >= RLIM_NLIMITS)
>  		return -EINVAL;
> +	resource = array_index_nospec(resource, RLIM_NLIMITS);
> +
>  	if (new_rlim) {
>  		if (new_rlim->rlim_cur > new_rlim->rlim_max)
>  			return -EINVAL;
> -- 
> 2.39.0
> 

This is already in the 6.1.8 release so no need to add it again :)

thanks,

greg k-h