lkml.org 
[lkml]   [2012]   [Jan]   [6]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Subject[PATCH] score: fix off-by-one index into syscall table
From
Date
If the provided system call number is equal to __NR_syscalls, the
current check will pass and a function pointer just after the system
call table may be called, since sys_call_table is an array with total
size __NR_syscalls. Whether or not this is a security bug depends on
what the compiler puts immediately after the system call table. It's
likely that this won't do anything bad because there is an additional
NULL check on the syscall entry, but if there happens to be a non-NULL
value immediately after the system call table, this may result in local
privilege escalation.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Cc: security@kernel.org
---
arch/score/kernel/entry.S | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/arch/score/kernel/entry.S b/arch/score/kernel/entry.S
index 577abba..83bb960 100644
--- a/arch/score/kernel/entry.S
+++ b/arch/score/kernel/entry.S
@@ -408,7 +408,7 @@ ENTRY(handle_sys)
sw r9, [r0, PT_EPC]

cmpi.c r27, __NR_syscalls # check syscall number
- bgtu illegal_syscall
+ bgeu illegal_syscall

slli r8, r27, 2 # get syscall routine
la r11, sys_call_table



\
 
 \ /
  Last update: 2012-01-06 14:31    [W:0.035 / U:0.148 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site