Messages in this thread Patch in this message | | | Date | Fri, 14 Dec 2012 14:51:25 -0800 | From | Kees Cook <> | Subject | [PATCH] firmware: make sure paths remain relative |
| |
Some devices have configurable firmware locations. If these configuration mechanisms are exposed to unprivileged userspace, it may be possible to load firmware from an unexpected location. To minimize the risk of this, make sure the string "../" does not appear in the firmware name. This means that neither the users of request_firmware, nor the uevent handler have to do this filtering themselves.
Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/base/firmware_class.c | 3 +++ 1 file changed, 3 insertions(+)
diff --git a/drivers/base/firmware_class.c b/drivers/base/firmware_class.c index d814603..9c4fb1c 100644 --- a/drivers/base/firmware_class.c +++ b/drivers/base/firmware_class.c @@ -814,6 +814,9 @@ _request_firmware_prepare(const struct firmware **firmware_p, const char *name, if (!firmware_p) return ERR_PTR(-EINVAL); + if (strstr(name, "../")) + return ERR_PTR(-EINVAL); + *firmware_p = firmware = kzalloc(sizeof(*firmware), GFP_KERNEL); if (!firmware) { dev_err(device, "%s: kmalloc(struct firmware) failed\n", -- 1.7.9.5
-- Kees Cook Chrome OS Security
| |