Bugzilla – Bug 64782
VUL-0: CVE-2005-0180: grsecurity: sg_scsi_ioctl integer overflow
Last modified: 2021-10-27 11:44:30 UTC
from grsecurity. in drivers/block/scsi_ioctl.c::sg_scsi_ioctl the Scsi_Ioctl_Command contains unsigned ints, it however reads out singed ints for in_len and out_len. they are later compared > PAGE_SIZE ... and not checked for underflow. I was not yet able to reproduce a problem with it. reading the amd64 assembler it seems it does an unsigned comparison, so it does not find the problem.
<!-- SBZ_reproduce --> n/a
Created attachment 27598 [details] Make the value in question unsigned This should fix it, ok to commit?
I committed it to SP1, question is whether we will issue a SLES9GA update as well before SP1 hits the streets? Should I commit to GA as well?
please do not commit to GA yet. but please commit to HEAD and 9.2. also get it to mainline ;)
Done, committed to HEAD and SLES92.
The patch is in mainline. Assigning to Marcus since I don't know how to further follow up on this.
jens, its already as patch in our next update kernels. so we are on it.
Thanks Marcus!
actually this might even be a non issue in the existing code.
amd64: The comparison before patch: ffffffff8026757e: 81 f9 00 10 00 00 cmp $0x1000,%ecx ffffffff80267584: 0f 97 c2 seta %dl ffffffff80267587: 81 7c 24 2c 00 10 00 cmpl $0x1000,0x2c(%rsp) ffffffff8026758e: 00 ffffffff8026758f: 0f 97 c0 seta %al ffffffff80267592: 09 d0 or %edx,%eax ffffffff80267594: 89 ea mov %ebp,%edx ffffffff80267596: a8 01 test $0x1,%al The comparison after the patch: ffffffff8026757e: 81 f9 00 10 00 00 cmp $0x1000,%ecx ffffffff80267584: 0f 97 c2 seta %dl ffffffff80267587: 81 7c 24 30 00 10 00 cmpl $0x1000,0x30(%rsp) ffffffff8026758e: 00 ffffffff8026758f: 0f 97 c0 seta %al ffffffff80267592: 09 d0 or %edx,%eax ffffffff80267594: 89 ea mov %ebp,%edx ffffffff80267596: a8 01 test $0x1,%al except the stack offset this is unchanged.
ppc64: the code is different, one does sign extension, one does not. :(
Created attachment 27713 [details] xx.c testcode
this code has the same conditions basically as the function in question. On all platforms this outputs: $ ./xx Hallo Welt 2. $ (I admit this is not the fully same code.)
CAN-2005-0180 possibly.
updates released.
CVE-2005-0180: CVSS v2 Base Score: 3.6 (AV:L/AC:L/Au:N/C:P/I:P/A:N)