From owner-freebsd-bugs@FreeBSD.ORG Sun Dec 27 21:50:02 2009 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 358D6106566B for ; Sun, 27 Dec 2009 21:50:02 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id ED72F8FC17 for ; Sun, 27 Dec 2009 21:50:01 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.3/8.14.3) with ESMTP id nBRLo189014289 for ; Sun, 27 Dec 2009 21:50:01 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.3/8.14.3/Submit) id nBRLo16e014288; Sun, 27 Dec 2009 21:50:01 GMT (envelope-from gnats) Resent-Date: Sun, 27 Dec 2009 21:50:01 GMT Resent-Message-Id: <200912272150.nBRLo16e014288@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Jakub Klama Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 9B9C41065695 for ; Sun, 27 Dec 2009 21:44:56 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from www.freebsd.org (www.freebsd.org [IPv6:2001:4f8:fff6::21]) by mx1.freebsd.org (Postfix) with ESMTP id 5DDB18FC1C for ; Sun, 27 Dec 2009 21:44:56 +0000 (UTC) Received: from www.freebsd.org (localhost [127.0.0.1]) by www.freebsd.org (8.14.3/8.14.3) with ESMTP id nBRLitfY015489 for ; Sun, 27 Dec 2009 21:44:55 GMT (envelope-from nobody@www.freebsd.org) Received: (from nobody@localhost) by www.freebsd.org (8.14.3/8.14.3/Submit) id nBRLitUD015488; Sun, 27 Dec 2009 21:44:55 GMT (envelope-from nobody) Message-Id: <200912272144.nBRLitUD015488@www.freebsd.org> Date: Sun, 27 Dec 2009 21:44:55 GMT From: Jakub Klama To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/142083: buffer overflow in vfs_mountroot_try (sys/kern/vfs_mount.c) X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 27 Dec 2009 21:50:02 -0000 >Number: 142083 >Category: kern >Synopsis: buffer overflow in vfs_mountroot_try (sys/kern/vfs_mount.c) >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Sun Dec 27 21:50:01 UTC 2009 >Closed-Date: >Last-Modified: >Originator: Jakub Klama >Release: 7.0-RELEASE-p5 >Organization: >Environment: FreeBSD remotehell.sc.czest.pl 7.0-RELEASE-p5 FreeBSD 7.0-RELEASE-p5 #0: Fri Nov 14 13:26:06 CET 2008 root@remotehell.sc.czest.pl:/usr/obj/usr/src/sys/REMOTEHELL i386 >Description: There's memory corruption after "vfsname" or "path" buffers by one byte (trailing \0), reported by WITNESS when user enters mount path with elements longer than MFSNAMELEN or MNAMELEN. It's caused by too short buffer malloc'd in lines 1722 and 1723 of vfs_mount.c (or too long string sscanf'd): http://fxr.watson.org/fxr/source/kern/vfs_mount.c?v=FREEBSD7#L1721: 1721 /* parse vfs name and path */ 1722 vfsname = malloc(MFSNAMELEN, M_MOUNT, M_WAITOK); 1723 path = malloc(MNAMELEN, M_MOUNT, M_WAITOK); 1724 vfsname[0] = path[0] = 0; 1725 sprintf(patt, "%%%d[a-z0-9]:%%%ds", MFSNAMELEN, MNAMELEN); 1726 if (sscanf(mountfrom, patt, vfsname, path) < 1) 1727 goto out; >How-To-Repeat: Enter any string longer than 16 characters without ":" in it with WITNESS kernel option enabled in mountroot prompt. >Fix: a) malloc one byte longer buffer (and adjust other kernel structures, if any, to use one byte longer buffer) b) sscanf() MFSNAMELEN-1 instead of MFSNAMELEN and MNAMELEN-1 instead of MNAMELEN >Release-Note: >Audit-Trail: >Unformatted: