diff options
| author | Mateusz Jurczyk <[email protected]> | 2017-07-12 14:34:01 -0700 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2017-07-12 16:26:00 -0700 |
| commit | 9380fa60b10ebd6ee7c3fcdb2cf162f4d7cf9fc5 (patch) | |
| tree | 025e603827b5f0cbba45a25eabaa85b416f00f9d | |
| parent | 7c43a657a4beadeb6d2fe1a00732261e313a807f (diff) | |
kernel/sysctl_binary.c: check name array length in deprecated_sysctl_warning()
Prevent use of uninitialized memory (originating from the stack frame of
do_sysctl()) by verifying that the name array is filled with sufficient
input data before comparing its specific entries with integer constants.
Through timing measurement or analyzing the kernel debug logs, a
user-mode program could potentially infer the results of comparisons
against the uninitialized memory, and acquire some (very limited)
information about the state of the kernel stack. The change also
eliminates possible future warnings by tools such as KMSAN and other
code checkers / instrumentations.
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Mateusz Jurczyk <[email protected]>
Acked-by: Kees Cook <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: Matthew Whitehead <[email protected]>
Cc: "Eric W. Biederman" <[email protected]>
Cc: Tetsuo Handa <[email protected]>
Cc: Alexander Potapenko <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
| -rw-r--r-- | kernel/sysctl_binary.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/kernel/sysctl_binary.c b/kernel/sysctl_binary.c index 939a158eab11..02e1859f2ca8 100644 --- a/kernel/sysctl_binary.c +++ b/kernel/sysctl_binary.c @@ -1346,7 +1346,7 @@ static void deprecated_sysctl_warning(const int *name, int nlen) * CTL_KERN/KERN_VERSION is used by older glibc and cannot * ever go away. */ - if (name[0] == CTL_KERN && name[1] == KERN_VERSION) + if (nlen >= 2 && name[0] == CTL_KERN && name[1] == KERN_VERSION) return; if (printk_ratelimit()) { |