Date: Wed, 12 Sep 2018 05:07:35 +0000 (UTC) From: Gordon Tetlow <gordon@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-releng@freebsd.org Subject: svn commit: r338606 - in releng: 10.4 10.4/sys/conf 10.4/sys/kern 11.1 11.1/sys/conf 11.1/sys/kern 11.2 11.2/sys/conf 11.2/sys/kern Message-ID: <201809120507.w8C57ZlT020790@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: gordon Date: Wed Sep 12 05:07:35 2018 New Revision: 338606 URL: https://svnweb.freebsd.org/changeset/base/338606 Log: Fix improper elf header parsing. [SA-18:12.elf] Approved by: so Security: FreeBSD-SA-18:12.elf Security: CVE-2018-6924 Modified: releng/10.4/UPDATING releng/10.4/sys/conf/newvers.sh releng/10.4/sys/kern/imgact_elf.c releng/10.4/sys/kern/vfs_vnops.c releng/11.1/UPDATING releng/11.1/sys/conf/newvers.sh releng/11.1/sys/kern/imgact_elf.c releng/11.1/sys/kern/vfs_vnops.c releng/11.2/UPDATING releng/11.2/sys/conf/newvers.sh releng/11.2/sys/kern/imgact_elf.c releng/11.2/sys/kern/vfs_vnops.c Modified: releng/10.4/UPDATING ============================================================================== --- releng/10.4/UPDATING Wed Sep 12 05:03:30 2018 (r338605) +++ releng/10.4/UPDATING Wed Sep 12 05:07:35 2018 (r338606) @@ -17,6 +17,10 @@ stable/10, and then rebuild without this option. The b older version of current is a bit fragile. +20180912 p12 FreeBSD-SA-18:12.elf + + Fix improper elf header parsing. + 20180814 p11 FreeBSD-SA-18:08.tcp [revised] FreeBSD-SA-18:11.hostapd Modified: releng/10.4/sys/conf/newvers.sh ============================================================================== --- releng/10.4/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605) +++ releng/10.4/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606) @@ -32,7 +32,7 @@ TYPE="FreeBSD" REVISION="10.4" -BRANCH="RELEASE-p11" +BRANCH="RELEASE-p12" if [ "X${BRANCH_OVERRIDE}" != "X" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/10.4/sys/kern/imgact_elf.c ============================================================================== --- releng/10.4/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/10.4/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606) @@ -795,7 +795,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -825,6 +826,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: Modified: releng/10.4/sys/kern/vfs_vnops.c ============================================================================== --- releng/10.4/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/10.4/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606) @@ -510,6 +510,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base; Modified: releng/11.1/UPDATING ============================================================================== --- releng/11.1/UPDATING Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.1/UPDATING Wed Sep 12 05:07:35 2018 (r338606) @@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20180912 p14 FreeBSD-SA-18:12.elf + FreeBSD-EN-18:08.lazyfpu + + Fix improper elf header parsing. [SA-18:12.elf] + + Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu] + 20180814 p13 FreeBSD-SA-18:08.tcp [revised] FreeBSD-SA-18:09.l1tf FreeBSD-SA-18:10.ip Modified: releng/11.1/sys/conf/newvers.sh ============================================================================== --- releng/11.1/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.1/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606) @@ -44,7 +44,7 @@ TYPE="FreeBSD" REVISION="11.1" -BRANCH="RELEASE-p13" +BRANCH="RELEASE-p14" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/11.1/sys/kern/imgact_elf.c ============================================================================== --- releng/11.1/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.1/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606) @@ -834,7 +834,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -864,6 +865,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: Modified: releng/11.1/sys/kern/vfs_vnops.c ============================================================================== --- releng/11.1/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.1/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606) @@ -529,6 +529,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base; Modified: releng/11.2/UPDATING ============================================================================== --- releng/11.2/UPDATING Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.2/UPDATING Wed Sep 12 05:07:35 2018 (r338606) @@ -16,6 +16,13 @@ from older versions of FreeBSD, try WITHOUT_CLANG and the tip of head, and then rebuild without this option. The bootstrap process from older version of current across the gcc/clang cutover is a bit fragile. +20180912 p3 FreeBSD-SA-18:12.elf + FreeBSD-EN-18:08.lazyfpu + + Fix improper elf header parsing. [SA-18:12.elf] + + Fix regression in Lazy FPU remediation. [EN-18:08.lazyfpu] + 20180814 p2 FreeBSD-SA-18:08.tcp [revised] FreeBSD-SA-18:09.l1tf FreeBSD-SA-18:10.ip Modified: releng/11.2/sys/conf/newvers.sh ============================================================================== --- releng/11.2/sys/conf/newvers.sh Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.2/sys/conf/newvers.sh Wed Sep 12 05:07:35 2018 (r338606) @@ -44,7 +44,7 @@ TYPE="FreeBSD" REVISION="11.2" -BRANCH="RELEASE-p2" +BRANCH="RELEASE-p3" if [ -n "${BRANCH_OVERRIDE}" ]; then BRANCH=${BRANCH_OVERRIDE} fi Modified: releng/11.2/sys/kern/imgact_elf.c ============================================================================== --- releng/11.2/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.2/sys/kern/imgact_elf.c Wed Sep 12 05:07:35 2018 (r338606) @@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -869,6 +870,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: Modified: releng/11.2/sys/kern/vfs_vnops.c ============================================================================== --- releng/11.2/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605) +++ releng/11.2/sys/kern/vfs_vnops.c Wed Sep 12 05:07:35 2018 (r338606) @@ -528,6 +528,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base;
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201809120507.w8C57ZlT020790>