linux-kernel - [PATCH] module: .strtab must be null terminated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <5uwynkpfhtqbrq47nqvp2ixpjhstjl7o7uxqp3b6snj233tvzi@avfrbljjpdel>
Date: Sat, 19 Oct 2024 16:14:40 +0200
From: Tobias Stoeckmann <tobias@...eckmann.org>
To: mcgrof@...nel.org
Cc: linux-modules@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] module: .strtab must be null terminated

The string table must be NUL-terminated, just like the section name table.

Signed-off-by: Tobias Stoeckmann <tobias@...eckmann.org>
---
In order to create a proof of concept, which I can't get into a simple
script right now, it's easiest to move '.strtab' to the end of the module
file, write as many 'A' characters at the end as required according to the
section size, and try to insert the module.

In dmesg, you can see lines like:

```
poc: Unknown symbol AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\xc6\xe9<\xfe\xff\xff\x8b
\xff\xc1\xe9\x03\xf3H\xa5\xeb\xa1I\x8b~ \xe8 (err -2)
```
---
 kernel/module/main.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/kernel/module/main.c b/kernel/module/main.c
index 49b9bca9d..9c5b373a7 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c
@@ -1847,6 +1847,18 @@ static int elf_validity_cache_copy(struct load_info *info, int flags)
 	info->index.str = shdr->sh_link;
 	info->strtab = (char *)info->hdr + info->sechdrs[info->index.str].sh_offset;

+	/*
+	 * The string table must be NUL-terminated, as required
+	 * by the spec. This makes strcmp and pr_* calls that access
+	 * strings in the section safe.
+	 */
+	strhdr = &info->sechdrs[info->index.str];
+	if (strhdr->sh_size > 0 && info->strtab[strhdr->sh_size - 1] != '\0') {
+		pr_err("module %s: string table isn't null terminated\n",
+		       info->name ?: "(missing .modinfo section or name field)");
+		goto no_exec;
+	}
+
 	/*
 	 * The ".gnu.linkonce.this_module" ELF section is special. It is
 	 * what modpost uses to refer to __this_module and let's use rely
--
2.47.0