Date: Sun, 24 Jan 2016 16:31:43 +0000 From: bugzilla-noreply@freebsd.org To: freebsd-bugs@FreeBSD.org Subject: [Bug 206581] bxe_ioctl_nvram handler is faulty Message-ID: <bug-206581-8@https.bugs.freebsd.org/bugzilla/>
next in thread | raw e-mail | index | archive | help
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=3D206581 Bug ID: 206581 Summary: bxe_ioctl_nvram handler is faulty Product: Base System Version: 11.0-CURRENT Hardware: Any OS: Any Status: New Severity: Affects Only Me Priority: --- Component: kern Assignee: freebsd-bugs@FreeBSD.org Reporter: ecturt@gmail.com Take a look at the start of `bxe_ioctl_nvram` from `sys/dev/bxe/bxe.c`: static int bxe_ioctl_nvram(struct bxe_softc *sc, uint32_t priv_op, struct ifreq *ifr) { struct bxe_nvram_data nvdata_base; struct bxe_nvram_data *nvdata; int len; int error =3D 0; copyin(ifr->ifr_data, &nvdata_base, sizeof(nvdata_base)); len =3D (sizeof(struct bxe_nvram_data) + nvdata_base.len - sizeof(uint32_t)); if (len > sizeof(struct bxe_nvram_data)) { if ((nvdata =3D (struct bxe_nvram_data *) malloc(len, M_DEVBUF, (M_NOWAIT | M_ZERO))) =3D=3D NULL) { BLOGE(sc, "BXE_IOC_RD_NVRAM malloc failed\n"); return (1); } memcpy(nvdata, &nvdata_base, sizeof(struct bxe_nvram_data)); } else { nvdata =3D &nvdata_base; } ... } Firstly, the result from `copyin` isn't even checked here... Secondly, no bound checks on user supplied `nvdata_base.len`, means we can = get `len` to overflow (since it is a `signed int`). For example, give an input length of `0x80000000 + sizeof(uint32_t)) - (sizeof(struct bxe_nvram_data)`= to get an allocation of 0 bytes, and then boom, we have heap overflow straight after: memcpy(nvdata, &nvdata_base, sizeof(struct bxe_nvram_data)); --=20 You are receiving this mail because: You are the assignee for the bug.=
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?bug-206581-8>