lkml.org 
[lkml]   [2014]   [Feb]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] sched: fix information leak in sys_sched_getattr()
    Date
    From: Vegard Nossum <vegard.nossum@oracle.com>

    We're copying the on-stack structure to userspace, but forgot to give
    the right number of bytes to copy. This allows the calling process to
    obtain up to PAGE_SIZE bytes from the stack (and possibly adjacent
    kernel memory).

    This fix copies only as much as we actually have on the stack
    (attr->size defaults to the size of the struct) and leaves the rest of
    the userspace-provided buffer untouched.

    Found using kmemcheck + trinity.

    Fixes: d50dde5a10f30 ("sched: Add new scheduler syscalls to support an extended scheduling parameters ABI")
    Cc: Dario Faggioli <raistlin@linux.it>
    Cc: Juri Lelli <juri.lelli@gmail.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Signed-off-by: Vegard Nossum <vegard.nossum@oracle.com>
    ---
    kernel/sched/core.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/kernel/sched/core.c b/kernel/sched/core.c
    index b46131e..ac939c3 100644
    --- a/kernel/sched/core.c
    +++ b/kernel/sched/core.c
    @@ -3786,7 +3786,7 @@ static int sched_read_attr(struct sched_attr __user *uattr,
    attr->size = usize;
    }

    - ret = copy_to_user(uattr, attr, usize);
    + ret = copy_to_user(uattr, attr, attr->size);
    if (ret)
    return -EFAULT;

    --
    1.7.10.4


    \
     
     \ /
      Last update: 2014-02-16 23:02    [W:3.590 / U:0.888 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site