3c00cb5e68
This function can leak kernel stack data when the user siginfo_t has a
positive si_code value. The top 16 bits of si_code descibe which fields
in the siginfo_t union are active, but they are treated inconsistently
between copy_siginfo_from_user32, copy_siginfo_to_user32 and
copy_siginfo_to_user.
copy_siginfo_from_user32 is called from rt_sigqueueinfo and
rt_tgsigqueueinfo in which the user has full control overthe top 16 bits
of si_code.
This fixes the following information leaks:
x86: 8 bytes leaked when sending a signal from a 32-bit process to
itself. This leak grows to 16 bytes if the process uses x32.
(si_code = __SI_CHLD)
x86: 100 bytes leaked when sending a signal from a 32-bit process to
a 64-bit process. (si_code = -1)
sparc: 4 bytes leaked when sending a signal from a 32-bit process to a
64-bit process. (si_code = any)
parsic and s390 have similar bugs, but they are not vulnerable because
rt_[tg]sigqueueinfo have checks that prevent sending a positive si_code
to a different process. These bugs are also fixed for consistency.
Signed-off-by: Amanieu d'Antras <amanieu@gmail.com>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Russell King <rmk@arm.linux.org.uk>
Cc: Ralf Baechle <ralf@linux-mips.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Chris Metcalf <cmetcalf@ezchip.com>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Michael Ellerman <mpe@ellerman.id.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
||
|---|---|---|
| .. | ||
| vdso | ||
| asm-offsets.c | ||
| backtrace.c | ||
| compat.c | ||
| compat_signal.c | ||
| early_printk.c | ||
| entry.S | ||
| ftrace.c | ||
| hardwall.c | ||
| head_32.S | ||
| head_64.S | ||
| hvglue.S | ||
| hvglue_trace.c | ||
| intvec_32.S | ||
| intvec_64.S | ||
| irq.c | ||
| kgdb.c | ||
| kprobes.c | ||
| machine_kexec.c | ||
| Makefile | ||
| mcount_64.S | ||
| messaging.c | ||
| module.c | ||
| pci-dma.c | ||
| pci.c | ||
| pci_gx.c | ||
| perf_event.c | ||
| pmc.c | ||
| proc.c | ||
| process.c | ||
| ptrace.c | ||
| reboot.c | ||
| regs_32.S | ||
| regs_64.S | ||
| relocate_kernel_32.S | ||
| relocate_kernel_64.S | ||
| setup.c | ||
| signal.c | ||
| single_step.c | ||
| smp.c | ||
| smpboot.c | ||
| stack.c | ||
| sys.c | ||
| sysfs.c | ||
| tile-desc_32.c | ||
| tile-desc_64.c | ||
| time.c | ||
| tlb.c | ||
| traps.c | ||
| unaligned.c | ||
| usb.c | ||
| vdso.c | ||
| vmlinux.lds.S | ||