lkml.org 
[lkml]   [2009]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] sgi-gru: Fix kernel stack buffer overrun
    Date
    This patch fixes a kernel stack buffer overrun in the sgi-gru procfs
    interface implementation.
    The "count" parameter to options_write() is user controlled. So this bug
    can be used to write '\0' bytes to almost arbitrary places on the kernel stack.

    Signed-off-by: Michael Buesch <mb@bu3sch.de>
    Cc: stable@kernel.org

    ---

    This procfs file has 0644 permissions, so the bug is probably not exploitable
    for local privilege escalation.

    ---
    drivers/misc/sgi-gru/gruprocfs.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    --- linux-2.6.orig/drivers/misc/sgi-gru/gruprocfs.c
    +++ linux-2.6/drivers/misc/sgi-gru/gruprocfs.c
    @@ -157,23 +157,23 @@ static int options_show(struct seq_file
    seq_printf(s, "0x%lx\n", gru_options);
    return 0;
    }

    static ssize_t options_write(struct file *file, const char __user *userbuf,
    size_t count, loff_t *data)
    {
    unsigned long val;
    char buf[80];

    + memset(buf, 0, sizeof(buf));
    if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0)
    return -EFAULT;
    - buf[count - 1] = '\0';
    if (!strict_strtoul(buf, 10, &val))
    gru_options = val;

    return count;
    }

    static int cch_seq_show(struct seq_file *file, void *data)
    {
    long gid = *(long *)data;
    int i;
    --
    Greetings, Michael.


    \
     
     \ /
      Last update: 2009-07-21 00:13    [W:0.020 / U:5.688 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site