lkml.org 
[lkml]   [2018]   [Oct]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    Date
    SubjectRe: [PATCH] net: socket: fix a missing-check bug
    Hi Florian,

    Thanks for your response. The bug is found with the assistance of a
    research prototype, which is now not available to the public.

    Yes, this is a kind of time-of-check-to-time-of-use (TOCTTOU) bug.

    BTW, could you please confirm this bug? Thanks!

    Wenwen

    On Sat, Oct 20, 2018 at 10:21 PM Florian Fainelli <f.fainelli@gmail.com> wrote:
    >
    > Hi Wenwen,
    >
    > On October 20, 2018 8:58:10 AM PDT, Wenwen Wang <wang6495@umn.edu> wrote:
    > >In ethtool_ioctl(), the ioctl command is firstly obtained from the
    > >user-space buffer 'compat_rxnfc' through get_user() and saved to
    > >'ethcmd'.
    > >Then, 'ethcmd' is checked to see whether it is necessary to pre-process
    > >the
    > >ethool structure, because the structure ethtool_rxnfc is defined with
    > >padding, as mentioned in the comment. If yes, a user-space buffer
    > >'rxnfc'
    > >is allocated through compat_alloc_user_space() and then the data in the
    > >original buffer 'compat_rxnfc' is copied to 'rxnfc' through
    > >copy_in_user(),
    > >including the ioctl command. It is worth noting that after this copy,
    > >there
    > >is no check enforced on the copied ioctl command. That means it is
    > >possible
    > >that 'rxnfc->cmd' is different from 'ethcmd', because a malicious user
    > >can
    > >race to modify the ioctl command in 'compat_rxnfc' between these two
    > >copies. Eventually, the ioctl command in 'rxnfc' will be used in
    > >dev_ethtool(). This can cause undefined behavior of the kernel and
    > >introduce potential security risk.
    > >
    > >This patch avoids the above issue by rewriting 'rxnfc->cmd' using
    > >'ethcmd'
    > >after copy_in_user().
    > >
    > >Signed-off-by: Wenwen Wang <wang6495@umn.edu>
    >
    > Assuming these issues are found with some kind of automated analysis, can you also add in your work flow to provide a Fixes: tag such that this could be backported to stable kernels?
    >
    > If this is found by a tool is this something that is open source and somehow available? I would also make it clear that these issues are typically named time TOCTOU which might be clearer for people who review those patches.
    >
    > Thanks!
    > --
    > Florian

    \
     
     \ /
      Last update: 2018-10-29 19:55    [W:3.169 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site