netdev - Potential kernel address leakage in driver/atm.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CABXRUiSdJD477FVdTEN8VVm5yqsJ3u-=FsX2fBN2+KWK3HrVPw@mail.gmail.com>
Date:   Mon, 15 Apr 2019 23:04:11 +0800
From:   Fuqian Huang <huangfq.daxian@...il.com>
To:     3chas3@...il.com, linux-atm-general@...ts.sourceforge.net,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Potential kernel address leakage in driver/atm.

Hi, recently I found that there is a kernel address leakage to user
space via copy_to_user in
drivers/atm/iphase.c:2772 (linux-5.0.7)
In ia_ioctl, when cmd is MEMDUMP_DEV, copy_to_user will copy struct
IADEV from ia_dev[board] to user space.
The struct is initialized in ia_init_one(line 3185/3211) and the pci
and next_board field are kernel pointers assigned in line 3191 and
3224.

Related code:
static int ia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
{
    ...
    iadev = kzalloc(...);
    ...
    iadev->pci =  pdev;
    ...
    iadev->next_board = ia_boards;
    ...
}

static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
{
    ...
    IADEV *iadev;
    ...
    iadev = ia_dev[board];
    ...
    switch (ia_cmds.cmd) {
        ...
        case MEMDUMP_DEV:
        ...
        if (copy_to_user(ia_cmds.buf, iadev, sizeof(IADEV)))
        ...
    }
}