Skip site navigation (1)Skip section navigation (2) 
Date:      Thu, 16 May 2019 11:59:02 +0000
From:      bugzilla-noreply@freebsd.org
To:        bugs@FreeBSD.org
Subject:   [Bug 237922] Kernel stack disclosure in function freebsd32_swapcontext of sys/arm64/arm64/freebsd32_machdep.c
Message-ID:  <bug-237922-227@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help 
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D237922

            Bug ID: 237922
           Summary: Kernel stack disclosure in function
                    freebsd32_swapcontext of
                    sys/arm64/arm64/freebsd32_machdep.c
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Many People
          Priority: ---
         Component: kern
          Assignee: bugs@FreeBSD.org
          Reporter: yangx92@hotmail.com

There is a kernel stack disclosure vulnerability in function
freebsd32_swapcontext of sys/arm64/arm64/freebsd32_machdep.c.


int
freebsd32_swapcontext(struct thread *td, struct freebsd32_swapcontext_args
*uap)
{
        ucontext32_t uc;
        int ret;

        if (uap->oucp =3D=3D NULL || uap->ucp =3D=3D NULL)
                ret =3D EINVAL;
        else {
+               bzero(&uc, sizeof(uc));
                get_mcontext32(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
                PROC_LOCK(td->td_proc);
                uc.uc_sigmask =3D td->td_sigmask;
                PROC_UNLOCK(td->td_proc);
                ret =3D copyout(&uc, uap->oucp, UC32_COPY_SIZE);
                if (ret =3D=3D 0) {
                        ret =3D copyin(uap->ucp, &uc, UC32_COPY_SIZE);
                        if (ret =3D=3D 0) {
                                ret =3D set_mcontext32(td, &uc.uc_mcontext);
                                kern_sigprocmask(td, SIG_SETMASK,
                                                &uc.uc_sigmask, NULL, 0);
                        }
                }
        }
        return (ret);
}

There is no initialization in else branch, which can lead to leaking stack
information to user space. This is the vulnerability that are same with
CVE-2018-17155 which was fixed in
https://github.com/freebsd/freebsd/commit/ca2c73670f229fe64818fd64c8cdd5b51=
7912966.

--=20
You are receiving this mail because:
You are the assignee for the bug.=

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-237922-227>