From: Alexey Sheplyakov <asheplyakov@basealt.ru> To: devel@lists.altlinux.org Cc: nir@basealt.ru, Alexey Sheplyakov <asheplyakov@altlinux.org>, boyarsh@altlinux.org Subject: [devel] [PATCH] AltHa: avoid kernel stack overflow Date: Fri, 14 Jan 2022 19:18:23 +0400 Message-ID: <20220114151823.239944-1-asheplyakov@basealt.ru> (raw) From: Alexey Sheplyakov <asheplyakov@altlinux.org> * The kernel stack on most architectures is 4096 bytes. * PATH_MAX is also 4096 (bytes). Therefore * Allocating PATH_MAX bytes on the stack definitely overflows the (kernel) stack (perhaps this can be exploited by creating a long enough path). To avoid the problem allocate `path_buffer` on the heap (and free it on all code paths) * CONFIG_FRAME_WARN=6144 (which is 1.5x the kernel stack size) is wrong and dangerous (it papers over actual overflows and creates a false sense of safety), use the default value instead (2048 bytes, which is a half of the kernel stack) Signed-off-by: Alexey Sheplyakov <asheplyakov@altlinux.org> --- config | 2 +- security/altha/altha_lsm.c | 21 ++++++++++++++++++--- 2 files changed, 19 insertions(+), 4 deletions(-) diff --git a/config b/config index da093b3f8e64..5ef328887321 100644 --- a/config +++ b/config @@ -10347,7 +10347,7 @@ CONFIG_DEBUG_INFO_BTF=y CONFIG_PAHOLE_HAS_SPLIT_BTF=y CONFIG_DEBUG_INFO_BTF_MODULES=y # CONFIG_GDB_SCRIPTS is not set -CONFIG_FRAME_WARN=6144 +CONFIG_FRAME_WARN=2048 # CONFIG_STRIP_ASM_SYMS is not set # CONFIG_READABLE_ASM is not set # CONFIG_HEADERS_INSTALL is not set diff --git a/security/altha/altha_lsm.c b/security/altha/altha_lsm.c index ccde83ebb26c..c670ad7ed458 100644 --- a/security/altha/altha_lsm.c +++ b/security/altha/altha_lsm.c @@ -243,8 +243,13 @@ static int altha_bprm_creds_from_file(struct linux_binprm *bprm, struct file * f struct altha_list_struct *node; /* when it's not a shebang issued script interpreter */ if (rstrscript_enabled && bprm->executable == bprm->interpreter) { - char path_buffer[PATH_MAX]; char *path_p; + char *path_buffer; + + path_buffer = kmalloc(PATH_MAX, GFP_KERNEL); + if (!path_buffer) + return -ENOMEM; + path_p = d_path(&bprm->file->f_path,path_buffer,PATH_MAX); down_read(&interpreters_sem); list_for_each_entry(node, &interpreters_list, list) { @@ -255,16 +260,24 @@ static int altha_bprm_creds_from_file(struct linux_binprm *bprm, struct file * f ("AltHa/RestrScript: %s is blocked to run directly by %d\n", bprm->filename, cur_uid); up_read(&interpreters_sem); + kfree(path_buffer); return -EPERM; } } up_read(&interpreters_sem); + kfree(path_buffer); } if (unlikely(nosuid_enabled && !uid_eq(bprm->cred->uid, bprm->cred->euid))) { - char path_buffer[PATH_MAX]; char *path_p; - uid_t cur_uid = from_kuid(bprm->cred->user_ns, bprm->cred->uid); + char *path_buffer; + uid_t cur_uid; + + path_buffer = kmalloc(PATH_MAX, GFP_KERNEL); + if (!path_buffer) + return -ENOMEM; + + cur_uid = from_kuid(bprm->cred->user_ns, bprm->cred->uid); path_p = d_path(&bprm->file->f_path,path_buffer,PATH_MAX); down_read(&nosuid_exceptions_sem); list_for_each_entry(node, &nosuid_exceptions_list, list) { @@ -273,6 +286,7 @@ static int altha_bprm_creds_from_file(struct linux_binprm *bprm, struct file * f ("AltHa/NoSUID: %s permitted to setuid from %d\n", bprm->filename, cur_uid); up_read(&nosuid_exceptions_sem); + kfree(path_buffer); return 0; } } @@ -281,6 +295,7 @@ static int altha_bprm_creds_from_file(struct linux_binprm *bprm, struct file * f ("AltHa/NoSUID: %s prevented to setuid from %d\n", bprm->filename, cur_uid); bprm->cred->euid = bprm->cred->uid; + kfree(path_buffer); } return 0; } -- 2.32.0
next reply other threads:[~2022-01-14 15:18 UTC|newest] Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top 2022-01-14 15:18 Alexey Sheplyakov [this message] 2022-01-14 16:34 ` Vladimir D. Seleznev 2022-01-17 7:43 ` Anton V. Boyarshinov
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20220114151823.239944-1-asheplyakov@basealt.ru \ --to=asheplyakov@basealt.ru \ --cc=asheplyakov@altlinux.org \ --cc=boyarsh@altlinux.org \ --cc=devel@lists.altlinux.org \ --cc=nir@basealt.ru \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
ALT Linux Team development discussions This inbox may be cloned and mirrored by anyone: git clone --mirror http://lore.altlinux.org/devel/0 devel/git/0.git # If you have public-inbox 1.1+ installed, you may # initialize and index your mirror using the following commands: public-inbox-init -V2 devel devel/ http://lore.altlinux.org/devel \ devel@altlinux.org devel@altlinux.ru devel@lists.altlinux.org devel@lists.altlinux.ru devel@linux.iplabs.ru mandrake-russian@linuxteam.iplabs.ru sisyphus@linuxteam.iplabs.ru public-inbox-index devel Example config snippet for mirrors. Newsgroup available over NNTP: nntp://lore.altlinux.org/org.altlinux.lists.devel AGPL code for this site: git clone https://public-inbox.org/public-inbox.git