lkml.org 
[lkml]   [2019]   [Apr]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectPotential kernel address leakage in driver/atm.
Hi, recently I found that there is a kernel address leakage to user
space via copy_to_user in
drivers/atm/iphase.c:2772 (linux-5.0.7)
In ia_ioctl, when cmd is MEMDUMP_DEV, copy_to_user will copy struct
IADEV from ia_dev[board] to user space.
The struct is initialized in ia_init_one(line 3185/3211) and the pci
and next_board field are kernel pointers assigned in line 3191 and
3224.

Related code:
static int ia_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
{
...
iadev = kzalloc(...);
...
iadev->pci = pdev;
...
iadev->next_board = ia_boards;
...
}

static int ia_ioctl(struct atm_dev *dev, unsigned int cmd, void __user *arg)
{
...
IADEV *iadev;
...
iadev = ia_dev[board];
...
switch (ia_cmds.cmd) {
...
case MEMDUMP_DEV:
...
if (copy_to_user(ia_cmds.buf, iadev, sizeof(IADEV)))
...
}
}

\
 
 \ /
  Last update: 2019-04-15 17:04    [W:0.018 / U:2.500 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site