DF-0070 / fix.diff
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 | diff --git a/sys/kern/kern_checkpoint.c b/sys/kern/kern_checkpoint.c --- a/sys/kern/kern_checkpoint.c +++ b/sys/kern/kern_checkpoint.c @@ -73,7 +73,7 @@ static int elf_loadphdrs(struct file *fp, Elf_Phdr *phdr, int numsegs); static int elf_getnotes(struct lwp *lp, struct file *fp, size_t notesz); -static int elf_demarshalnotes(void *src, prpsinfo_t *psinfo, +static int elf_demarshalnotes(void *src, size_t srcsz, prpsinfo_t *psinfo, prstatus_t *status, prfpregset_t *fpregset, int nthreads); static int elf_loadnotes(struct lwp *, prpsinfo_t *, prstatus_t *, prfpregset_t *); @@ -197,7 +197,7 @@ PRINTF(("reading notes section\n")); if ((error = read_check(fp, note, notesz)) != 0) goto done; - error = elf_demarshalnotes(note, psinfo, status, fpregset, nthreads); + error = elf_demarshalnotes(note, notesz, psinfo, status, fpregset, nthreads); if (error) goto done; /* fetch register state from notes */ @@ -311,10 +311,11 @@ } static int -elf_getnote(void *src, size_t *off, const char *name, unsigned int type, - void **desc, size_t descsz) +elf_getnote(void *src, size_t *off, size_t srcsz, const char *name, + unsigned int type, void **desc, size_t descsz) { Elf_Note note; + size_t namesz_pad, descsz_pad; int error; TRACE_ENTER; @@ -322,6 +323,16 @@ error = EFAULT; goto done; } + /* + * Validate every access against the source buffer size before + * touching the data. Without these checks a crafted n_namesz / + * n_descsz drives *off past the buffer and the bcopy() below reads + * kernel heap out of bounds (DF-0070). + */ + if (*off > srcsz || srcsz - *off < sizeof(note)) { + error = EINVAL; + goto done; + } bcopy((char *)src + *off, ¬e, sizeof note); PRINTF(("at offset: %zd expected note of type: %d - got: %d\n", @@ -332,19 +343,31 @@ error = EINVAL; goto done; } + /* Guard against an attacker-inflated n_namesz and the OOB strncmp. */ + namesz_pad = roundup2(note.n_namesz, sizeof(Elf_Size)); + if (note.n_namesz > 32 || namesz_pad > srcsz - *off) { + error = EINVAL; + goto done; + } if (strncmp(name, (char *) src + *off, note.n_namesz) != 0) { error = EINVAL; goto done; } - *off += roundup2(note.n_namesz, sizeof(Elf_Size)); + *off += namesz_pad; if (note.n_descsz != descsz) { TRACE_ERR; error = EINVAL; goto done; } + /* Guard the descriptor bcopy against an OOB read. */ + descsz_pad = roundup2(note.n_descsz, sizeof(Elf_Size)); + if (descsz_pad > srcsz - *off) { + error = EINVAL; + goto done; + } if (desc) bcopy((char *)src + *off, *desc, note.n_descsz); - *off += roundup2(note.n_descsz, sizeof(Elf_Size)); + *off += descsz_pad; error = 0; done: TRACE_EXIT; @@ -352,23 +375,23 @@ } static int -elf_demarshalnotes(void *src, prpsinfo_t *psinfo, prstatus_t *status, - prfpregset_t *fpregset, int nthreads) +elf_demarshalnotes(void *src, size_t srcsz, prpsinfo_t *psinfo, + prstatus_t *status, prfpregset_t *fpregset, int nthreads) { int i; int error; size_t off = 0; TRACE_ENTER; - error = elf_getnote(src, &off, "CORE", NT_PRPSINFO, + error = elf_getnote(src, &off, srcsz, "CORE", NT_PRPSINFO, (void **)&psinfo, sizeof(prpsinfo_t)); if (error) goto done; - error = elf_getnote(src, &off, "CORE", NT_PRSTATUS, + error = elf_getnote(src, &off, srcsz, "CORE", NT_PRSTATUS, (void **)&status, sizeof(prstatus_t)); if (error) goto done; - error = elf_getnote(src, &off, "CORE", NT_FPREGSET, + error = elf_getnote(src, &off, srcsz, "CORE", NT_FPREGSET, (void **)&fpregset, sizeof(prfpregset_t)); if (error) goto done; @@ -379,11 +402,11 @@ */ for (i = 0 ; i < nthreads - 1; i++) { status++; fpregset++; - error = elf_getnote(src, &off, "CORE", NT_PRSTATUS, + error = elf_getnote(src, &off, srcsz, "CORE", NT_PRSTATUS, (void **)&status, sizeof (prstatus_t)); if (error) goto done; - error = elf_getnote(src, &off, "CORE", NT_FPREGSET, + error = elf_getnote(src, &off, srcsz, "CORE", NT_FPREGSET, (void **)&fpregset, sizeof(prfpregset_t)); if (error) goto done; |