Skip site navigation (1)Skip section navigation (2) 
Date:      Wed, 12 Sep 2018 04:57:34 +0000 (UTC)
From:      Gordon Tetlow <gordon@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r338603 - head/sys/kern
Message-ID:  <201809120457.w8C4vYmc015768@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: gordon
Date: Wed Sep 12 04:57:34 2018
New Revision: 338603
URL: https://svnweb.freebsd.org/changeset/base/338603

Log:
  Correct ELF header parsing code to prevent invalid ELF sections from
  disclosing memory.
  
  Submitted by:	markj
  Reported by:	Thomas Barabosch, Fraunhofer FKIE
  Approved by:	re (implicit)
  Approved by:	so
  Security:	FreeBSD-SA-18:12.elf
  Security:	CVE-2018-6924
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/sys/kern/imgact_elf.c
  head/sys/kern/vfs_vnops.c

Modified: head/sys/kern/imgact_elf.c
==============================================================================
--- head/sys/kern/imgact_elf.c	Tue Sep 11 23:54:31 2018	(r338602)
+++ head/sys/kern/imgact_elf.c	Wed Sep 12 04:57:34 2018	(r338603)
@@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
 			break;
 		case PT_INTERP:
 			/* Path to interpreter */
-			if (phdr[i].p_filesz > MAXPATHLEN) {
+			if (phdr[i].p_filesz < 2 ||
+			    phdr[i].p_filesz > MAXPATHLEN) {
 				uprintf("Invalid PT_INTERP\n");
 				error = ENOEXEC;
 				goto ret;
@@ -870,6 +871,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
 			} else {
 				interp = __DECONST(char *, imgp->image_header) +
 				    phdr[i].p_offset;
+				if (interp[interp_name_len - 1] != '\0') {
+					uprintf("Invalid PT_INTERP\n");
+					error = ENOEXEC;
+					goto ret;
+				}
 			}
 			break;
 		case PT_GNU_STACK:

Modified: head/sys/kern/vfs_vnops.c
==============================================================================
--- head/sys/kern/vfs_vnops.c	Tue Sep 11 23:54:31 2018	(r338602)
+++ head/sys/kern/vfs_vnops.c	Wed Sep 12 04:57:34 2018	(r338603)
@@ -527,6 +527,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, 
 	struct vn_io_fault_args args;
 	int error, lock_flags;
 
+	if (offset < 0 && vp->v_type != VCHR)
+		return (EINVAL);
 	auio.uio_iov = &aiov;
 	auio.uio_iovcnt = 1;
 	aiov.iov_base = base;

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201809120457.w8C4vYmc015768>