lkml.org 
[lkml]   [2022]   [Jun]   [7]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.17 528/772] module: fix [e_shstrndx].sh_size=0 OOB access
    Date
    From: Alexey Dobriyan <adobriyan@gmail.com>

    [ Upstream commit 391e982bfa632b8315235d8be9c0a81374c6a19c ]

    It is trivial to craft a module to trigger OOB access in this line:

    if (info->secstrings[strhdr->sh_size - 1] != '\0') {

    BUG: unable to handle page fault for address: ffffc90000aa0fff
    PGD 100000067 P4D 100000067 PUD 100066067 PMD 10436f067 PTE 0
    Oops: 0000 [#1] PREEMPT SMP PTI
    CPU: 7 PID: 1215 Comm: insmod Not tainted 5.18.0-rc5-00007-g9bf578647087-dirty #10
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/01/2014
    RIP: 0010:load_module+0x19b/0x2391

    Fixes: ec2a29593c83 ("module: harden ELF info handling")
    Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
    [rebased patch onto modules-next]
    Signed-off-by: Luis Chamberlain <mcgrof@kernel.org>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    kernel/module.c | 4 ++++
    1 file changed, 4 insertions(+)

    diff --git a/kernel/module.c b/kernel/module.c
    index 46a5c2ed1928..740323cff545 100644
    --- a/kernel/module.c
    +++ b/kernel/module.c
    @@ -3033,6 +3033,10 @@ static int elf_validity_check(struct load_info *info)
    * strings in the section safe.
    */
    info->secstrings = (void *)info->hdr + strhdr->sh_offset;
    + if (strhdr->sh_size == 0) {
    + pr_err("empty section name table\n");
    + goto no_exec;
    + }
    if (info->secstrings[strhdr->sh_size - 1] != '\0') {
    pr_err("ELF Spec violation: section name table isn't null terminated\n");
    goto no_exec;
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-06-07 23:28    [W:2.635 / U:0.544 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site