Date: Mon, 16 Mar 2020 21:12:33 +0000 (UTC) From: "Bjoern A. Zeeb" <bz@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r359020 - stable/11/sys/kern Message-ID: <202003162112.02GLCX22080549@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: bz Date: Mon Mar 16 21:12:32 2020 New Revision: 359020 URL: https://svnweb.freebsd.org/changeset/base/359020 Log: MFC r358992: kern_jail: missing \0 termination check on osrelease parameter If a user spplies a non-\0 terminated osrelease parameter reading it back may disclose kernel memory. This is a problem in case of nested jails (children.max > 0, which is not the default). Otherwise root outside the jail has access to kernel memory by other means and root inside a jail cannot create a child jail. Add the proper \0 check at the end of a supplied osrelease parameter and make sure any copies of the field will be \0-terminated. Submitted by: Hans Christian Woithe (chwoithe yahoo.com) Modified: stable/11/sys/kern/kern_jail.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/kern/kern_jail.c ============================================================================== --- stable/11/sys/kern/kern_jail.c Mon Mar 16 19:33:50 2020 (r359019) +++ stable/11/sys/kern/kern_jail.c Mon Mar 16 21:12:32 2020 (r359020) @@ -881,8 +881,12 @@ kern_jail_set(struct thread *td, struct uio *optuio, i "osrelease cannot be changed after creation"); goto done_errmsg; } - if (len == 0 || len >= OSRELEASELEN) { + if (len == 0 || osrelstr[len - 1] != '\0') { error = EINVAL; + goto done_free; + } + if (len >= OSRELEASELEN) { + error = ENAMETOOLONG; vfs_opterror(opts, "osrelease string must be 1-%d bytes long", OSRELEASELEN - 1); @@ -1272,9 +1276,11 @@ kern_jail_set(struct thread *td, struct uio *optuio, i pr->pr_osreldate = osreldt ? osreldt : ppr->pr_osreldate; if (osrelstr == NULL) - strcpy(pr->pr_osrelease, ppr->pr_osrelease); + strlcpy(pr->pr_osrelease, ppr->pr_osrelease, + sizeof(pr->pr_osrelease)); else - strcpy(pr->pr_osrelease, osrelstr); + strlcpy(pr->pr_osrelease, osrelstr, + sizeof(pr->pr_osrelease)); LIST_INIT(&pr->pr_children); mtx_init(&pr->pr_mtx, "jail mutex", NULL, MTX_DEF | MTX_DUPOK);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202003162112.02GLCX22080549>