lkml.org 
[lkml]   [2009]   [Jul]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
From
Subject[PATCH] sgi-gru: Fix kernel stack buffer overrun
Date
This patch fixes a kernel stack buffer overrun in the sgi-gru procfs
interface implementation.
The "count" parameter to options_write() is user controlled. So this bug
can be used to write '\0' bytes to almost arbitrary places on the kernel stack.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Cc: stable@kernel.org

---

This procfs file has 0644 permissions, so the bug is probably not exploitable
for local privilege escalation.

---
drivers/misc/sgi-gru/gruprocfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.orig/drivers/misc/sgi-gru/gruprocfs.c
+++ linux-2.6/drivers/misc/sgi-gru/gruprocfs.c
@@ -157,23 +157,23 @@ static int options_show(struct seq_file
seq_printf(s, "0x%lx\n", gru_options);
return 0;
}

static ssize_t options_write(struct file *file, const char __user *userbuf,
size_t count, loff_t *data)
{
unsigned long val;
char buf[80];

+ memset(buf, 0, sizeof(buf));
if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0)
return -EFAULT;
- buf[count - 1] = '\0';
if (!strict_strtoul(buf, 10, &val))
gru_options = val;

return count;
}

static int cch_seq_show(struct seq_file *file, void *data)
{
long gid = *(long *)data;
int i;
--
Greetings, Michael.


\
 
 \ /
  Last update: 2009-07-21 00:13    [W:0.032 / U:0.384 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site