svn commit: r340994 - in head/sys: amd64/ia32 mips/mips powerpc/powerpc

[Eric van Gyzen]

Author: vangyzen
Date: Mon Nov 26 20:50:55 2018
New Revision: 340994
URL: https://svnweb.freebsd.org/changeset/base/340994

Log:
  Prevent kernel stack disclosure in getcontext/swapcontext
  
  Expand r338982 to cover freebsd32 interfaces on amd64, mips, and powerpc.
  
  MFC after:	2 days
  Security:	FreeBSD-EN-18:12.mem
  Security:	CVE-2018-17155
  Sponsored by:	Dell EMC Isilon

Modified:
  head/sys/amd64/ia32/ia32_signal.c
  head/sys/mips/mips/freebsd32_machdep.c
  head/sys/powerpc/powerpc/exec_machdep.c

Modified: head/sys/amd64/ia32/ia32_signal.c
==============================================================================
--- head/sys/amd64/ia32/ia32_signal.c	Mon Nov 26 19:41:13 2018	(r340993)
+++ head/sys/amd64/ia32/ia32_signal.c	Mon Nov 26 20:50:55 2018	(r340994)
@@ -261,6 +261,7 @@ freebsd32_getcontext(struct thread *td, struct freebsd
 	if (uap->ucp == NULL)
 		ret = EINVAL;
 	else {
+		bzero(&uc, sizeof(uc));
 		ia32_get_mcontext(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
 		PROC_LOCK(td->td_proc);
 		uc.uc_sigmask = td->td_sigmask;
@@ -301,6 +302,7 @@ freebsd32_swapcontext(struct thread *td, struct freebs
 	if (uap->oucp == NULL || uap->ucp == NULL)
 		ret = EINVAL;
 	else {
+		bzero(&uc, sizeof(uc));
 		ia32_get_mcontext(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
 		PROC_LOCK(td->td_proc);
 		uc.uc_sigmask = td->td_sigmask;

Modified: head/sys/mips/mips/freebsd32_machdep.c
==============================================================================
--- head/sys/mips/mips/freebsd32_machdep.c	Mon Nov 26 19:41:13 2018	(r340993)
+++ head/sys/mips/mips/freebsd32_machdep.c	Mon Nov 26 20:50:55 2018	(r340994)
@@ -294,6 +294,7 @@ freebsd32_getcontext(struct thread *td, struct freebsd
 	if (uap->ucp == NULL)
 		ret = EINVAL;
 	else {
+		bzero(&uc, sizeof(uc));
 		get_mcontext32(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
 		PROC_LOCK(td->td_proc);
 		uc.uc_sigmask = td->td_sigmask;
@@ -333,6 +334,7 @@ freebsd32_swapcontext(struct thread *td, struct freebs
 	if (uap->oucp == NULL || uap->ucp == NULL)
 		ret = EINVAL;
 	else {
+		bzero(&uc, sizeof(uc));
 		get_mcontext32(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
 		PROC_LOCK(td->td_proc);
 		uc.uc_sigmask = td->td_sigmask;

Modified: head/sys/powerpc/powerpc/exec_machdep.c
==============================================================================
--- head/sys/powerpc/powerpc/exec_machdep.c	Mon Nov 26 19:41:13 2018	(r340993)
+++ head/sys/powerpc/powerpc/exec_machdep.c	Mon Nov 26 20:50:55 2018	(r340994)
@@ -785,6 +785,7 @@ freebsd32_getcontext(struct thread *td, struct freebsd
 	if (uap->ucp == NULL)
 		ret = EINVAL;
 	else {
+		bzero(&uc, sizeof(uc));
 		get_mcontext32(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
 		PROC_LOCK(td->td_proc);
 		uc.uc_sigmask = td->td_sigmask;
@@ -824,6 +825,7 @@ freebsd32_swapcontext(struct thread *td, struct freebs
 	if (uap->oucp == NULL || uap->ucp == NULL)
 		ret = EINVAL;
 	else {
+		bzero(&uc, sizeof(uc));
 		get_mcontext32(td, &uc.uc_mcontext, GET_MC_CLEAR_RET);
 		PROC_LOCK(td->td_proc);
 		uc.uc_sigmask = td->td_sigmask;