Attachment 27353 Details for Bug 64492

[patch] mail with proposed patch from marcello as attachment

marcello-49492.diff (text/plain), 6.53 KB, created by Ludwig Nussel on 2005-01-03 21:13:07 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-01-03 21:13:07 UTC

Size: 6.53 KB

patch

obsolete

>On Thu, Dec 30, 2004 at 03:48:35PM +0100, Paul Starzetz wrote:
>> On Wed, 29 Dec 2004, Marcelo Tosatti wrote:
>> 
>> > Hi Paul,
>> > 
>> > Can you describe whats going on at the kernel level? 
>> > 
>> > I really dont have the time to read and understand the exploit. Will take 
>> > some time to try it tomorrow. 
>> 
>> OK no prob, it was just too obvious for me.
>
>Well wasnt for me :) 
>
>> > The problem is in the sys_uselib() system call to select shared library, 
>> > but what is the race scenario ? 
>> 
>> There is a missing down() on the current->mm->mmap_sem semaphore while 
>> calling do_brk(). As you see (for 2.4 as well for 2.6) there is a 
>> down/up_write pair before around do_mmap, but none around do_brk. And 
>> looking into the code of sys_brk it is clear that do_brk is called with 
>> the semaphore held.
>> 
>> In other words: if do_brk() sleeps on kmalloc for the vm_area_struct it 
>> may insert the VMA in old place while the VMA list/tree has been modified 
>> by another thread. That is used by the exploit to create two overlapping 
>> VMAs like:
>> 
>> [A.......B]  VMA N
>>   [C...D]    VMA N+1
>> 
>> then it exploits the features of mremap() that calculates the maximum 
>> possible address for extending a VMA by taking the next VMA and building 
>> the difference between the requested address and next's vm_start... but if 
>> this is less than the vm_end of the previous VMA this will result in a big 
>> integer, something like (unsigned)-1 & ~4093 etc... The remaining work is 
>> analogous to the do_brk exploit.
>> 
>> Note that this is not a bug in mremap. I have found at least three 
>> different ways to exploit once we have overlapping VMAs...
>> 
>> Attached latest version, never tested on gcc 3.x (however statically 
>> linked 2.95 version works on a gcc 3.x compiled kernel). May need to be 
>> run few times with -s -b switches.
>
>OK I see, thanks for the explanation.
>
>Here is a fix against 2.4.29-pre3 to create new do_brk() to grab the mmap_sem and call 
>__do_brk (old do_brk()).
>
>This is much simpler than fixing each caller of do_brk - there are many in the binary 
>format loaders (ELF and aout).
>
>Andrew, if you're OK with the addition of lockless __do_brk() and locking do_brk() 
>as the following patch I can prepare a v2.6 patch.
>
>With this in place I can't crash my testbox anymore (it used to crash with Paul's
>exploit) - your exploit now eats all memory+swap and triggers OOM killer.
>
>
>diff -Nur linux-2.4.28.orig/arch/ia64/kernel/sys_ia64.c linux-2.4.28/arch/ia64/kernel/sys_ia64.c
>--- linux-2.4.28.orig/arch/ia64/kernel/sys_ia64.c	2004-12-31 15:21:15.117588248 -0200
>+++ linux-2.4.28/arch/ia64/kernel/sys_ia64.c	2004-12-31 15:29:43.833251712 -0200
>@@ -142,7 +142,7 @@
> 		goto out;
> 
> 	/* Ok, looks good - let it rip. */
>-	if (do_brk(oldbrk, newbrk-oldbrk) != oldbrk)
>+	if (__do_brk(oldbrk, newbrk-oldbrk) != oldbrk)
> 		goto out;
> set_brk:
> 	mm->brk = brk;
>diff -Nur linux-2.4.28.orig/arch/mips/kernel/sysirix.c linux-2.4.28/arch/mips/kernel/sysirix.c
>--- linux-2.4.28.orig/arch/mips/kernel/sysirix.c	2004-12-31 15:21:15.292561648 -0200
>+++ linux-2.4.28/arch/mips/kernel/sysirix.c	2004-12-31 15:30:03.311290600 -0200
>@@ -588,7 +588,7 @@
> 	 * Ok, looks good - let it rip.
> 	 */
> 	mm->brk = brk;
>-	do_brk(oldbrk, newbrk-oldbrk);
>+	__do_brk(oldbrk, newbrk-oldbrk);
> 	ret = 0;
> 
> out:
>diff -Nur linux-2.4.28.orig/arch/sparc/kernel/sys_sunos.c linux-2.4.28/arch/sparc/kernel/sys_sunos.c
>--- linux-2.4.28.orig/arch/sparc/kernel/sys_sunos.c	2004-12-31 15:21:15.389546904 -0200
>+++ linux-2.4.28/arch/sparc/kernel/sys_sunos.c	2004-12-31 15:30:44.029100552 -0200
>@@ -205,7 +205,7 @@
> 	 * Ok, we have probably got enough memory - let it rip.
> 	 */
> 	current->mm->brk = brk;
>-	do_brk(oldbrk, newbrk-oldbrk);
>+	__do_brk(oldbrk, newbrk-oldbrk);
> 	retval = 0;
> out:
> 	up_write(&current->mm->mmap_sem);
>diff -Nur linux-2.4.28.orig/arch/sparc64/kernel/sys_sunos32.c linux-2.4.28/arch/sparc64/kernel/sys_sunos32.c
>--- linux-2.4.28.orig/arch/sparc64/kernel/sys_sunos32.c	2004-12-31 15:21:15.571519240 -0200
>+++ linux-2.4.28/arch/sparc64/kernel/sys_sunos32.c	2004-12-31 15:31:24.532943032 -0200
>@@ -167,7 +167,7 @@
> 		goto out;
> 	/* Ok, we have probably got enough memory - let it rip. */
> 	current->mm->brk = brk;
>-	do_brk(oldbrk, newbrk-oldbrk);
>+	__do_brk(oldbrk, newbrk-oldbrk);
> 	retval = 0;
> out:
> 	up_write(&current->mm->mmap_sem);
>diff -Nur linux-2.4.28.orig/include/linux/mm.h linux-2.4.28/include/linux/mm.h
>--- linux-2.4.28.orig/include/linux/mm.h	2004-12-31 15:21:17.710194112 -0200
>+++ linux-2.4.28/include/linux/mm.h	2004-12-31 15:25:20.494285320 -0200
>@@ -574,6 +574,7 @@
> 
> extern int do_munmap(struct mm_struct *, unsigned long, size_t);
> 
>+extern unsigned long __do_brk(unsigned long, unsigned long);
> extern unsigned long do_brk(unsigned long, unsigned long);
> 
> static inline void __vma_unlink(struct mm_struct * mm, struct vm_area_struct * vma, struct vm_area_struct * prev)
>diff -Nur linux-2.4.28.orig/kernel/ksyms.c linux-2.4.28/kernel/ksyms.c
>--- linux-2.4.28.orig/kernel/ksyms.c	2004-12-31 15:21:15.782487168 -0200
>+++ linux-2.4.28/kernel/ksyms.c	2004-12-31 15:32:30.574903128 -0200
>@@ -87,6 +87,7 @@
> /* process memory management */
> EXPORT_SYMBOL(do_mmap_pgoff);
> EXPORT_SYMBOL(do_munmap);
>+EXPORT_SYMBOL(__do_brk);
> EXPORT_SYMBOL(do_brk);
> EXPORT_SYMBOL(exit_mm);
> EXPORT_SYMBOL(exit_files);
>diff -Nur linux-2.4.28.orig/mm/mmap.c linux-2.4.28/mm/mmap.c
>--- linux-2.4.28.orig/mm/mmap.c	2004-12-31 15:21:14.880624272 -0200
>+++ linux-2.4.28/mm/mmap.c	2004-12-31 15:26:41.029042176 -0200
>@@ -181,7 +181,7 @@
> 		goto out;
> 
> 	/* Ok, looks good - let it rip. */
>-	if (do_brk(oldbrk, newbrk-oldbrk) != oldbrk)
>+	if (__do_brk(oldbrk, newbrk-oldbrk) != oldbrk)
> 		goto out;
> set_brk:
> 	mm->brk = brk;
>@@ -1031,12 +1031,13 @@
> 	return ret;
> }
> 
>+
> /*
>  *  this is really a simplified "do_mmap".  it only handles
>  *  anonymous maps.  eventually we may be able to do some
>  *  brk-specific accounting here.
>  */
>-unsigned long do_brk(unsigned long addr, unsigned long len)
>+unsigned long __do_brk(unsigned long addr, unsigned long len)
> {
> 	struct mm_struct * mm = current->mm;
> 	struct vm_area_struct * vma, * prev;
>@@ -1116,6 +1117,18 @@
> 	return addr;
> }
> 
>+/* locking version of __do_brk. */
>+unsigned long do_brk(unsigned long addr, unsigned long len)
>+{
>+	unsigned long ret;
>+
>+	down_write(&current->mm->mmap_sem);
>+	ret = __do_brk(addr, len);
>+	up_write(&current->mm->mmap_sem);
>+
>+	return ret;
>+}
>+
> /* Build the RB tree corresponding to the VMA list. */
> void build_mmap_rb(struct mm_struct * mm)
> {
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View | Diff

Attachments on bug 64492: 27352 | 27353 | 27368 | 27369 | 27370 | 27371 | 27372 | 27375 | 27376 | 27380 | 27510 | 27534 | 33137