lkml.org 
[lkml]   [2002]   [Oct]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] EVMS core 3/4: evms_ioctl.h
On Thu, Oct 03, 2002 at 05:30:46PM -0500, Kevin Corry wrote:
> In general, we are aware of the issues with using 32-bit user-space on top of
> 64-bit kernel. If you take a look at evms.c you will find several functions
> that get registered at init-time with the 32-to-64-bit ioctl conversion code.
> These take care of translating pointers from user-space to kernel-space in
> this situation. EVMS has been tested on ppc64 with success, and we have
> someone currently running tests on sparc64 to make sure it works there as
> well.

I think you have some security holes in there:

+parms.buffer_address = (u8 *)uvirt_to_kernel(parms32.buffer_address);
[...]
+set_fs(KERNEL_DS);
+rc = sys_ioctl(fd, kcmd, (unsigned long)karg);
+set_fs(old_fs);


parms32.buffer_address comes from user space. With the set_fs you turn
off all access checking. Surely when whatever sits at the bottom of
sys_ioctl accesses it it'll use copy_from/to_user and it will do an
unchecked reference of a user supplied pointer, allowing it to read/write
all memory.

Same bug is present in more functions.

The rule is: when you do set_fs(KERNEL_DS) you have to copy all user supplied
pointers before it.



-Andi
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:29    [W:0.038 / U:0.612 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site