Messages in this thread | | | Subject | Re: [PATCH] floppy: Do not copy a kernel pointer to user memory in FDGETPRM ioctl | From | Brian Belleville <> | Date | Thu, 22 Mar 2018 12:59:51 -0700 |
| |
Hi, are there any comments on this patch or the issue I described? I have tested the FDGETPRM ioctl and confirmed that the struct it returns does contain a pointer to kernel data. I also have tested my patch, and with it applied the returned struct no longer contains a kernel pointer, but all other fields are still present.
Thank you, Brian Belleville
On 03/07/2018 04:02 PM, Brian Belleville wrote: > The final field of a floppy_struct is the field "name", which is a > pointer to a string in kernel memory. The kernel pointer should not be > copied to user memory. The FDGETPRM ioctl copies a floppy_struct to > user memory, including the "name" field. This pointer cannot be used > by the user, and it will leak a kernel address to user-space, which > will reveal the location of kernel code and data and undermine KASLR > protection. Instead, copy the floppy_struct except for the "name" > field. > > Signed-off-by: Brian Belleville <bbellevi@uci.edu> > --- > drivers/block/floppy.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c > index eae484a..4d4a422 100644 > --- a/drivers/block/floppy.c > +++ b/drivers/block/floppy.c > @@ -3470,6 +3470,7 @@ static int fd_locked_ioctl(struct block_device *bdev, fmode_t mode, unsigned int > (struct floppy_struct **)&outparam); > if (ret) > return ret; > + size = offsetof(struct floppy_struct, name); > break; > case FDMSGON: > UDP->flags |= FTD_MSG; >
| |