lkml.org 
[lkml]   [2014]   [Aug]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 3.8 01/13] x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
    Date
    3.8.13.28 -stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Andy Lutomirski <luto@amacapital.net>

    commit 554086d85e71f30abe46fc014fea31929a7c6a8a upstream.

    The bad syscall nr paths are their own incomprehensible route
    through the entry control flow. Rearrange them to work just like
    syscalls that return -ENOSYS.

    This fixes an OOPS in the audit code when fast-path auditing is
    enabled and sysenter gets a bad syscall nr (CVE-2014-4508).

    This has probably been broken since Linux 2.6.27:
    af0575bba0 i386 syscall audit fast-path

    Cc: Roland McGrath <roland@redhat.com>
    Reported-by: Toralf Förster <toralf.foerster@gmx.de>
    Signed-off-by: Andy Lutomirski <luto@amacapital.net>
    Link: http://lkml.kernel.org/r/e09c499eade6fc321266dd6b54da7beb28d6991c.1403558229.git.luto@amacapital.net
    Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
    Signed-off-by: Kamal Mostafa <kamal@canonical.com>
    ---
    arch/x86/kernel/entry_32.S | 10 ++++++++--
    1 file changed, 8 insertions(+), 2 deletions(-)

    diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
    index 60d03c2..b32b466 100644
    --- a/arch/x86/kernel/entry_32.S
    +++ b/arch/x86/kernel/entry_32.S
    @@ -434,9 +434,10 @@ sysenter_past_esp:
    jnz sysenter_audit
    sysenter_do_call:
    cmpl $(NR_syscalls), %eax
    - jae syscall_badsys
    + jae sysenter_badsys
    call *sys_call_table(,%eax,4)
    movl %eax,PT_EAX(%esp)
    +sysenter_after_call:
    LOCKDEP_SYS_EXIT
    DISABLE_INTERRUPTS(CLBR_ANY)
    TRACE_IRQS_OFF
    @@ -686,7 +687,12 @@ END(syscall_fault)

    syscall_badsys:
    movl $-ENOSYS,PT_EAX(%esp)
    - jmp resume_userspace
    + jmp syscall_exit
    +END(syscall_badsys)
    +
    +sysenter_badsys:
    + movl $-ENOSYS,PT_EAX(%esp)
    + jmp sysenter_after_call
    END(syscall_badsys)
    CFI_ENDPROC
    /*
    --
    1.9.1
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2014-08-25 19:21    [W:3.480 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site