Messages in this thread | | | From | Martin Lau <> | Subject | Re: [PATCH] bpf: btf: Fix a missing-check bug | Date | Mon, 22 Oct 2018 15:40:35 +0000 |
| |
On Fri, Oct 19, 2018 at 05:29:51PM -0500, Wenwen Wang wrote: > In btf_parse(), the header of the user-space btf data 'btf_data' is firstly > parsed and verified through btf_parse_hdr(). In btf_parse_hdr(), the header > is copied from user-space 'btf_data' to kernel-space 'btf->hdr' and then > verified. If no error happens during the verification process, the whole > data of 'btf_data', including the header, is then copied to 'data' in > btf_parse(). It is obvious that the header is copied twice here. More > importantly, no check is enforced after the second copy to make sure the > headers obtained in these two copies are same. Given that 'btf_data' > resides in the user space, a malicious user can race to modify the header > between these two copies. By doing so, the user can inject inconsistent > data, which can cause undefined behavior of the kernel and introduce > potential security risk. > > To avoid the above issue, this patch rewrites the header after the second > copy, using 'btf->hdr', which is obtained in the first copy. Acked-by: Martin KaFai Lau <kafai@fb.com>
| |