Attachment 72753 Details for Bug 156580

[patch] 2.4 patch

24-sysret-fix (text/plain), 7.60 KB, created by Andreas Kleen on 2006-03-14 12:22:11 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Andreas Kleen

Created: 2006-03-14 12:22:11 UTC

Size: 7.60 KB

patch

obsolete

>From petrides@redhat.com Thu Mar  9 23:23:01 2006
>Return-Path: <petrides@redhat.com>
>Received: from imap.suse.de ([unix socket])
>	by imap-dhs (Cyrus v2.1.16) with LMTP; Thu, 09 Mar 2006 23:21:05 +0100
>X-Sieve: CMU Sieve 2.2
>Received: from Relay1.suse.de (relay1.suse.de [149.44.160.87])
>	(using TLSv1 with cipher EDH-RSA-DES-CBC3-SHA (168/168 bits))
>	(Client CN "relay.suse.de", Issuer "SuSE Linux AG internal IMAP-Server CA" (verified OK))
>	by imap.suse.de (Postfix) with ESMTP id 0EBF957EBE4
>	for <ak@imap-dhs.suse.de>; Thu,  9 Mar 2006 23:21:05 +0100 (CET)
>Received: by Relay1.suse.de (Postfix)
>	id 004F369F8B; Thu,  9 Mar 2006 23:21:04 +0100 (CET)
>Received: from Relay1.suse.de (localhost [127.0.0.1])
>	by Relay1.suse.de (Postfix) with ESMTP id E86B848428
>	for <ak@suse.de>; Thu,  9 Mar 2006 23:21:04 +0100 (CET)
>Received: from Relay1.suse.de ([127.0.0.1])
> by Relay1.suse.de (Relay1 [127.0.0.1]) (amavisd-new, port 10026) with ESMTP
> id 17679-14 for <ak@suse.de>; Thu,  9 Mar 2006 23:21:04 +0100 (CET)
>Received: from mx1.suse.de (cantor.suse.de [195.135.220.2])
>	(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
>	(No client certificate requested)
>	by Relay1.suse.de (Postfix) with ESMTP id A45A169F9C
>	for <ak@suse.de>; Thu,  9 Mar 2006 23:21:04 +0100 (CET)
>Received: from mx1.redhat.com (mx1.redhat.com [66.187.233.31])
>	by mx1.suse.de (Postfix) with ESMTP id 48C02ED1C
>	for <ak@suse.de>; Thu,  9 Mar 2006 23:21:04 +0100 (CET)
>Received: from int-mx1.corp.redhat.com (int-mx1.corp.redhat.com [172.16.52.254])
>	by mx1.redhat.com (8.12.11/8.12.11) with ESMTP id k29MKkTm032738;
>	Thu, 9 Mar 2006 17:20:46 -0500
>Received: from mail.boston.redhat.com (mail.boston.redhat.com [172.16.76.12])
>	by int-mx1.corp.redhat.com (8.11.6/8.11.6) with ESMTP id k29MKj109335;
>	Thu, 9 Mar 2006 17:20:45 -0500
>Received: from pasta.boston.redhat.com (pasta.boston.redhat.com [172.16.80.54])
>	by mail.boston.redhat.com (8.12.8/8.12.8) with ESMTP id k29MKits010794;
>	Thu, 9 Mar 2006 17:20:44 -0500
>Received: from pasta.boston.redhat.com (localhost.localdomain [127.0.0.1])
>	by pasta.boston.redhat.com (8.12.8/8.12.8) with ESMTP id k29MN1Y6024656;
>	Thu, 9 Mar 2006 17:23:01 -0500
>Received: from pasta.boston.redhat.com (ernie@localhost)
>	by pasta.boston.redhat.com (8.12.8/8.12.8/Submit) with ESMTP id k29MN1S9024652;
>	Thu, 9 Mar 2006 17:23:01 -0500
>Message-Id: <200603092223.k29MN1S9024652@pasta.boston.redhat.com>
>To: Andi Kleen <ak@suse.de>,
> Marcelo Tosatti <marcelo.tosatti@cyclades.com>
>Cc: Suresh Siddha <suresh.b.siddha@intel.com>,
> Asit K Mallick <asit.k.mallick@intel.com>,
> Dave Jones <davej@redhat.com>,
> Jason Baron <jbaron@redhat.com>,
> Ernie Petrides <petrides@redhat.com>,
> security@kernel.org,
> vendor-sec@lst.de
>Subject: Re: [patch] fix for signal catching vulnerability on EM64T cpus
>In-Reply-To: My message of "Wed, 08 Mar 2006 19:58:46 EST."
>             <200603090058.k290wkuu017903@pasta.boston.redhat.com>
>Date: Thu, 09 Mar 2006 17:23:01 -0500
>From: Ernie Petrides <petrides@redhat.com>
>X-Virus-Scanned: by amavisd-new at Relay1.suse.de
>X-Spam-Status: No, hits=-1.0 tagged_above=-20.0 required=5.0 tests=BAYES_50,
> MY_LINUX
>X-Spam-Level: 
>Content-Type: 
>X-UID: 81756
>X-Length: 7873
>
>Here's the final version of the RHEL3 (2.4.21-based) patch that I've
>proposed for internal review at Red Hat.  This will address the EM64T
>issues with bad ELF entry addresses (CVE-2006-0741) and signal catching.
>
>With this patch, all known cases of the x86_64 kernel returning to
>arbitrary (possibly non-canonical) user-mode RIPs have been addressed:
>
>  1) execve() system call
>
>  2) signal catching
>
>  3) returning from a signal handler
>
>  4) ptrace() system call using PTRACE_POKEUSR or PTRACE_SETREGS
>
>Note the deviation from upstream in fs/binfmt_elf.c.  The boundary case
>of "equal to TASK_SIZE" was not correct in BAD_ADDR(), but since the
>64-bit value for TASK_SIZE on x86_64 is one page less than the lowest
>non-canonical address, this change is not critical.
>
>Also, I feel that it's wrong to return ENOEXEC in the final checking in
>load_elf_binary() because at that point the user address space has been
>torn down, and it's not possible for an exec of any other executable
>format to succeed (and further, force_sig() should be used instead of
>send_sig() in case SIGSEGVs are being ignored).
>
>Cheers.  -ernie
>
>
>
>--- linux-2.4.21/fs/binfmt_elf.c.orig
>+++ linux-2.4.21/fs/binfmt_elf.c
>@@ -78,7 +78,7 @@ static struct linux_binfmt elf_format = 
> 	NULL, THIS_MODULE, load_elf_binary, load_elf_library, elf_core_dump, ELF_EXEC_PAGESIZE
> };
> 
>-#define BAD_ADDR(x)	((unsigned long)(x) > TASK_SIZE)
>+#define BAD_ADDR(x)	((unsigned long)(x) >= TASK_SIZE)
> 
> static int set_brk(unsigned long start, unsigned long end)
> {
>@@ -358,7 +358,7 @@ static unsigned long load_elf_interp(str
> 	    	elf_type |= MAP_FIXED;
> 
> 	    map_addr = elf_map(interpreter, load_addr + vaddr, eppnt, elf_prot,
>-elf_type, total_size);
>+				elf_type, total_size);
> 	    total_size = 0UL;
> 	    if (BAD_ADDR(map_addr)) {
> 	        error = map_addr;
>@@ -376,7 +376,7 @@ elf_type, total_size);
> 	     * <= p_memsz so it is only necessary to check p_memsz.
> 	     */
> 	    k = load_addr + eppnt->p_vaddr;
>-	    if (k > TASK_SIZE || eppnt->p_filesz > eppnt->p_memsz ||
>+	    if (BAD_ADDR(k) || eppnt->p_filesz > eppnt->p_memsz ||
> 		eppnt->p_memsz > TASK_SIZE || TASK_SIZE - eppnt->p_memsz < k) {
> 	        error = -ENOMEM;
> 		goto out_close;
>@@ -825,7 +825,7 @@ static int load_elf_binary(struct linux_
> 		 * allowed task size. Note that p_filesz must always be
> 		 * <= p_memsz so it is only necessary to check p_memsz.
> 		 */
>-		if (k > TASK_SIZE || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
>+		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
> 		    elf_ppnt->p_memsz > TASK_SIZE ||
> 		    TASK_SIZE - elf_ppnt->p_memsz < k) {
> 			/* set_brk can never work.  Avoid overflows.  */
>@@ -876,10 +876,9 @@ static int load_elf_binary(struct linux_
> 						    &interp_load_addr);
> 
> 		if (BAD_ADDR(elf_entry)) {
>-			printk(KERN_ERR "Unable to load interpreter\n");
>-			send_sig(SIGSEGV, current, 0);
>+			force_sig(SIGSEGV, current);
> 			retval = IS_ERR((void *)elf_entry) ?
>-					(int)elf_entry : -ENOEXEC;
>+					(int)elf_entry : -EINVAL;
> 			goto out_free_dentry;
> 		}
> 		reloc_func_desc = interp_load_addr;
>@@ -887,6 +886,12 @@ static int load_elf_binary(struct linux_
> 		allow_write_access(interpreter);
> 		fput(interpreter);
> 		kfree(elf_interpreter);
>+	} else {
>+		if (BAD_ADDR(elf_entry)) {
>+			force_sig(SIGSEGV, current);
>+			retval = -EINVAL;
>+			goto out_free_dentry;
>+		}
> 	}
> 
> 	kfree(elf_phdata);
>--- linux-2.4.21/arch/x86_64/kernel/signal.c.orig
>+++ linux-2.4.21/arch/x86_64/kernel/signal.c
>@@ -137,15 +137,15 @@ restore_sigcontext(struct pt_regs *regs,
> 
> 
> #define COPY(x)		err |= __get_user(regs->x, &sc->x)
>-#define COPY_CANON(x)   \
>-	COPY(x); \
>-	if ((regs->x >> 48)  != 0 && (regs->x >> 48) != 0xffff) \
>-				regs->x = 0; 
> 
> 	/* fs and gs are ignored because we cannot handle the 64bit base easily */ 
> 
>-	COPY(rdi); COPY(rsi); COPY(rbp); COPY_CANON(rsp); COPY(rbx);
>-	COPY(rdx); COPY(rcx); COPY_CANON(rip);
>+	COPY(rdi); COPY(rsi); COPY(rbp); COPY(rsp);
>+	if (unlikely(regs->rsp >= TASK_SIZE))
>+		regs->rsp = 0UL;
>+	COPY(rbx); COPY(rdx); COPY(rcx); COPY(rip);
>+	if (unlikely(regs->rip >= TASK_SIZE))
>+		regs->rip = 0UL;
> 	COPY(r8);
> 	COPY(r9);
> 	COPY(r10);
>@@ -378,7 +378,10 @@ static void setup_rt_frame(int sig, stru
> 	regs->rsi = (unsigned long)&frame->info; 
> 	regs->rdx = (unsigned long)&frame->uc; 
> 	regs->rsp = (unsigned long) frame;
>-	regs->rip = (unsigned long) ka->sa.sa_handler;
>+	if (unlikely((unsigned long)ka->sa.sa_handler >= TASK_SIZE))
>+		regs->rip = 0UL;
>+	else
>+		regs->rip = (unsigned long)ka->sa.sa_handler;
> 	regs->cs = __USER_CS;
> 	regs->ss = __USER_DS; 
> 
>

Actions: View | Diff

Attachments on bug 156580: 72752 | 72753 | 72754 | 75839 | 75840