diff options
| author | Demi Marie Obenour <demi@invisiblethingslab.com> | 2023-06-03 10:52:42 -0400 |
|---|---|---|
| committer | Mike Snitzer <snitzer@kernel.org> | 2023-06-23 10:31:51 -0400 |
| commit | 249bed821b4db6d95a99160f7d6d236ea5fe6362 (patch) | |
| tree | aaaa9fd19138ef1e53bad952fccf3f9ee8c77574 /lib/debugobjects.c | |
| parent | 10655c7a48570315343fdd9cc6acb261d57c2c7a (diff) | |
dm ioctl: Avoid double-fetch of version
The version is fetched once in check_version(), which then does some
validation and then overwrites the version in userspace with the API
version supported by the kernel. copy_params() then fetches the version
from userspace *again*, and this time no validation is done. The result
is that the kernel's version number is completely controllable by
userspace, provided that userspace can win a race condition.
Fix this flaw by not copying the version back to the kernel the second
time. This is not exploitable as the version is not further used in the
kernel. However, it could become a problem if future patches start
relying on the version field.
Cc: stable@vger.kernel.org
Signed-off-by: Demi Marie Obenour <demi@invisiblethingslab.com>
Signed-off-by: Mike Snitzer <snitzer@kernel.org>
Diffstat (limited to 'lib/debugobjects.c')
0 files changed, 0 insertions, 0 deletions