Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1207772

[PATCH 3.14 32/44] signal: fix information leak in copy_siginfo_from_user32

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 3.14 32/44] signal: fix information leak in copy_siginfo_from_user32
Date 2015-08-14 20:10 +0200
Message-ID <pXrAw-1fH-81@gated-at.bofh.it> (permalink)
References <pXrqO-OE-5@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

3.14-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Amanieu d'Antras <amanieu@gmail.com>

commit 3c00cb5e68dc719f2fc73a33b1b230aadfcb1309 upstream.

This function can leak kernel stack data when the user siginfo_t has a
positive si_code value.  The top 16 bits of si_code descibe which fields
in the siginfo_t union are active, but they are treated inconsistently
between copy_siginfo_from_user32, copy_siginfo_to_user32 and
copy_siginfo_to_user.

copy_siginfo_from_user32 is called from rt_sigqueueinfo and
rt_tgsigqueueinfo in which the user has full control overthe top 16 bits
of si_code.

This fixes the following information leaks:
x86:   8 bytes leaked when sending a signal from a 32-bit process to
       itself. This leak grows to 16 bytes if the process uses x32.
       (si_code = __SI_CHLD)
x86:   100 bytes leaked when sending a signal from a 32-bit process to
       a 64-bit process. (si_code = -1)
sparc: 4 bytes leaked when sending a signal from a 32-bit process to a
       64-bit process. (si_code = any)

parsic and s390 have similar bugs, but they are not vulnerable because
rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code
to a different process.  These bugs are also fixed for consistency.

Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/arm64/kernel/signal32.c    |    2 --
 arch/mips/kernel/signal32.c     |    2 --
 arch/powerpc/kernel/signal_32.c |    2 --
 kernel/signal.c                 |    4 ++--
 4 files changed, 2 insertions(+), 8 deletions(-)

--- a/arch/arm64/kernel/signal32.c
+++ b/arch/arm64/kernel/signal32.c
@@ -193,8 +193,6 @@ int copy_siginfo_to_user32(compat_siginf
 
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
 {
-	memset(to, 0, sizeof *to);
-
 	if (copy_from_user(to, from, __ARCH_SI_PREAMBLE_SIZE) ||
 	    copy_from_user(to->_sifields._pad,
 			   from->_sifields._pad, SI_PAD_SIZE))
--- a/arch/mips/kernel/signal32.c
+++ b/arch/mips/kernel/signal32.c
@@ -370,8 +370,6 @@ int copy_siginfo_to_user32(compat_siginf
 
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
 {
-	memset(to, 0, sizeof *to);
-
 	if (copy_from_user(to, from, 3*sizeof(int)) ||
 	    copy_from_user(to->_sifields._pad,
 			   from->_sifields._pad, SI_PAD_SIZE32))
--- a/arch/powerpc/kernel/signal_32.c
+++ b/arch/powerpc/kernel/signal_32.c
@@ -967,8 +967,6 @@ int copy_siginfo_to_user32(struct compat
 
 int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from)
 {
-	memset(to, 0, sizeof *to);
-
 	if (copy_from_user(to, from, 3*sizeof(int)) ||
 	    copy_from_user(to->_sifields._pad,
 			   from->_sifields._pad, SI_PAD_SIZE32))
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -3036,7 +3036,7 @@ COMPAT_SYSCALL_DEFINE3(rt_sigqueueinfo,
 			int, sig,
 			struct compat_siginfo __user *, uinfo)
 {
-	siginfo_t info;
+	siginfo_t info = {};
 	int ret = copy_siginfo_from_user32(&info, uinfo);
 	if (unlikely(ret))
 		return ret;
@@ -3082,7 +3082,7 @@ COMPAT_SYSCALL_DEFINE4(rt_tgsigqueueinfo
 			int, sig,
 			struct compat_siginfo __user *, uinfo)
 {
-	siginfo_t info;
+	siginfo_t info = {};
 
 	if (copy_siginfo_from_user32(&info, uinfo))
 		return -EFAULT;


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.14 00/44] 3.14.51-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:00 +0200
  [PATCH 3.14 40/44] dcache: dont need rcu in shrink_dentry_list() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:00 +0200
  [PATCH 3.14 44/44] mm, vmscan: Do not wait for page writeback for GFP_NOFS allocations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:00 +0200
  [PATCH 3.14 31/44] signal: fix information leak in copy_siginfo_to_user Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:00 +0200
  [PATCH 3.14 03/44] MIPS: Fix sched_getaffinity with MT FPAFF enabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:00 +0200
  [PATCH 3.14 42/44] path_openat(): fix double fput() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:00 +0200
  [PATCH 3.14 38/44] dont remove from shrink list in select_collect() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:00 +0200
  [PATCH 3.14 30/44] signalfd: fix information leak in signalfd_copyinfo Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:00 +0200
  [PATCH 3.14 24/44] ALSA: hda - fix cs4210_spdif_automute() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 20/44] crypto: ixp4xx - Remove bogus BUG_ON on scattered dst buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 25/44] ipc: modify message queue accounting to not take kernel data structures into account Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 18/44] x86/xen: Probe target addresses in set_aliased_prot() before the hypercall Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 21/44] rbd: fix copyup completion race Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 15/44] ARM: sunxi: fix build for THUMB2_KERNEL Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 13/44] ima: extend "mask" policy matching support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 22/44] ARM: OMAP2+: hwmod: Fix _wait_target_ready() for hwmods without sysc Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 27/44] PCI: Restore PCI_MSIX_FLAGS_BIRMASK definition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 05/44] fsnotify: fix oops in fsnotify_clear_marks_by_group_flags() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 34/44] fold try_prune_one_dentry() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 14/44] md: use kzalloc() when bitmap is disabled Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 17/44] ASoC: pcm1681: Fix setting de-emphasis sampling rate selection Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 23/44] iscsi-target: Fix iscsit_start_kthreads failure OOPs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 06/44] drm/radeon/combios: add some validation of lvds values Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 16/44] [PATCH] sparc64: Fix userspace FPU register corruptions. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 11/44] USB: sierra: add 1199:68AB device ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 26/44] ocfs2: fix BUG in ocfs2_downconvert_thread_do_work() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 12/44] ima: add support for new "euid" policy condition Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 01/44] ARM: realview: fix sparsemem build Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 33/44] fold d_kill() and d_free() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 02/44] MIPS: Malta: Dont reinitialise RTC Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 04/44] MIPS: Make set_pte() SMP safe. Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  [PATCH 3.14 32/44] signal: fix information leak in copy_siginfo_from_user32 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2015-08-14 20:10 +0200
  Re: [PATCH 3.14 00/44] 3.14.51-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-08-15 02:20 +0200
  Re: [PATCH 3.14 00/44] 3.14.51-stable review Guenter Roeck <linux@roeck-us.net> - 2015-08-15 17:20 +0200

csiph-web