lkml.org 
[lkml]   [2018]   [Aug]   [4]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 073/124] scsi: 3w-9xxx: fix a missing-check bug
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Wenwen Wang <wang6495@umn.edu>

    [ Upstream commit c9318a3e0218bc9dacc25be46b9eec363259536f ]

    In twa_chrdev_ioctl(), the ioctl driver command is firstly copied from
    the userspace pointer 'argp' and saved to the kernel object
    'driver_command'. Then a security check is performed on the data buffer
    size indicated by 'driver_command', which is
    'driver_command.buffer_length'. If the security check is passed, the
    entire ioctl command is copied again from the 'argp' pointer and saved
    to the kernel object 'tw_ioctl'. Then, various operations are performed
    on 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer
    resides in userspace, a malicious userspace process can race to change
    the buffer size between the two copies. This way, the user can bypass
    the security check and inject invalid data buffer size. This can cause
    potential security issues in the following execution.

    This patch checks for capable(CAP_SYS_ADMIN) in twa_chrdev_open()t o
    avoid the above issues.

    Signed-off-by: Wenwen Wang <wang6495@umn.edu>
    Acked-by: Adam Radford <aradford@gmail.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/scsi/3w-9xxx.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/drivers/scsi/3w-9xxx.c
    +++ b/drivers/scsi/3w-9xxx.c
    @@ -889,6 +889,11 @@ static int twa_chrdev_open(struct inode
    unsigned int minor_number;
    int retval = TW_IOCTL_ERROR_OS_ENODEV;

    + if (!capable(CAP_SYS_ADMIN)) {
    + retval = -EACCES;
    + goto out;
    + }
    +
    minor_number = iminor(inode);
    if (minor_number >= twa_device_extension_count)
    goto out;

    \
     
     \ /
      Last update: 2018-08-04 11:11    [W:3.115 / U:0.864 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site