lkml.org 
[lkml]   [2018]   [Aug]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 16/25] isdn: Disable IIOCDBGVAR
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Kees Cook <keescook@chromium.org>

    [ Upstream commit 5e22002aa8809e2efab2da95855f73f63e14a36c ]

    It was possible to directly leak the kernel address where the isdn_dev
    structure pointer was stored. This is a kernel ASLR bypass for anyone
    with access to the ioctl. The code had been present since the beginning
    of git history, though this shouldn't ever be needed for normal operation,
    therefore remove it.

    Reported-by: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Karsten Keil <isdn@linux-pingi.de>
    Signed-off-by: Kees Cook <keescook@chromium.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/isdn/i4l/isdn_common.c | 8 +-------
    1 file changed, 1 insertion(+), 7 deletions(-)

    --- a/drivers/isdn/i4l/isdn_common.c
    +++ b/drivers/isdn/i4l/isdn_common.c
    @@ -1655,13 +1655,7 @@ isdn_ioctl(struct file *file, uint cmd,
    } else
    return -EINVAL;
    case IIOCDBGVAR:
    - if (arg) {
    - if (copy_to_user(argp, &dev, sizeof(ulong)))
    - return -EFAULT;
    - return 0;
    - } else
    - return -EINVAL;
    - break;
    + return -EINVAL;
    default:
    if ((cmd & IIOCDRVCTL) == IIOCDRVCTL)
    cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK;

    \
     
     \ /
      Last update: 2018-08-21 08:38    [W:4.520 / U:0.288 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site