From owner-svn-src-stable@freebsd.org Wed Sep 12 05:02:12 2018 Return-Path: Delivered-To: svn-src-stable@mailman.ysv.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.ysv.freebsd.org (Postfix) with ESMTP id 1813E10A91C0; Wed, 12 Sep 2018 05:02:12 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client CN "mxrelay.nyi.freebsd.org", Issuer "Let's Encrypt Authority X3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id C1B747121A; Wed, 12 Sep 2018 05:02:11 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from repo.freebsd.org (repo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id BC9C321FD8; Wed, 12 Sep 2018 05:02:11 +0000 (UTC) (envelope-from gordon@FreeBSD.org) Received: from repo.freebsd.org ([127.0.1.37]) by repo.freebsd.org (8.15.2/8.15.2) with ESMTP id w8C52Bd5020463; Wed, 12 Sep 2018 05:02:11 GMT (envelope-from gordon@FreeBSD.org) Received: (from gordon@localhost) by repo.freebsd.org (8.15.2/8.15.2/Submit) id w8C52B7t020461; Wed, 12 Sep 2018 05:02:11 GMT (envelope-from gordon@FreeBSD.org) Message-Id: <201809120502.w8C52B7t020461@repo.freebsd.org> X-Authentication-Warning: repo.freebsd.org: gordon set sender to gordon@FreeBSD.org using -f From: Gordon Tetlow Date: Wed, 12 Sep 2018 05:02:11 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-11@freebsd.org Subject: svn commit: r338604 - stable/11/sys/kern X-SVN-Group: stable-11 X-SVN-Commit-Author: gordon X-SVN-Commit-Paths: stable/11/sys/kern X-SVN-Commit-Revision: 338604 X-SVN-Commit-Repository: base MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-stable@freebsd.org X-Mailman-Version: 2.1.27 Precedence: list List-Id: SVN commit messages for all the -stable branches of the src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 12 Sep 2018 05:02:12 -0000 Author: gordon Date: Wed Sep 12 05:02:11 2018 New Revision: 338604 URL: https://svnweb.freebsd.org/changeset/base/338604 Log: MFC 338603: Correct ELF header parsing code to prevent invalid ELF sections from disclosing memory. Submitted by: markj Reported by: Thomas Barabosch, Fraunhofer FKIE Approved by: so Security: FreeBSD-SA-18:12.elf Security: CVE-2018-6924 Sponsored by: The FreeBSD Foundation Modified: stable/11/sys/kern/imgact_elf.c stable/11/sys/kern/vfs_vnops.c Directory Properties: stable/11/ (props changed) Modified: stable/11/sys/kern/imgact_elf.c ============================================================================== --- stable/11/sys/kern/imgact_elf.c Wed Sep 12 04:57:34 2018 (r338603) +++ stable/11/sys/kern/imgact_elf.c Wed Sep 12 05:02:11 2018 (r338604) @@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -870,6 +871,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: Modified: stable/11/sys/kern/vfs_vnops.c ============================================================================== --- stable/11/sys/kern/vfs_vnops.c Wed Sep 12 04:57:34 2018 (r338603) +++ stable/11/sys/kern/vfs_vnops.c Wed Sep 12 05:02:11 2018 (r338604) @@ -528,6 +528,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base;