From nobody Wed Oct 22 20:15:27 2025 X-Original-To: dev-commits-src-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4csL4v3ldpz6DJ1K; Wed, 22 Oct 2025 20:15:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4csL4v2KGMz4JHR; Wed, 22 Oct 2025 20:15:27 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1761164127; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bVUcjx2+yEcXijAg2/u6yBdpqdcaUBowXC9R7kyXvfY=; b=g6r5invuxNhV5IH8YIF7Y+PYYoNvdZyR0Ql2ZDxJtDwzWanT3s0Er5uvtL81mhauz01Yv1 rFnMZYlYiYz/ExC6DONbrVdfBwBEAr81VDE/BTrEWPi1XYjysKtXcMGUYmQK8PoxrLeP/H lGLPtGvaeMiD82LFc8roG4WyXSb47uUeWuBh0dXZo2LJYXdVVWUepGDGOCJk9GEUQ+l9Uf aZbnuv5Aozg2iPG/UQz55Kvkf4mRXyO/2U3D/RcqUO5HYO0NNkhD1v1Yo5t2i3Q9HjOhTe 9aQzp2PjIpG6crT3QLvkcWV2xNqo6rculVQ6PBuu5peeCSrwIHBDhLb35Ol4jA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1761164127; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=bVUcjx2+yEcXijAg2/u6yBdpqdcaUBowXC9R7kyXvfY=; b=KWcWrkbg01P91TXqx/bl/07XDYCXyvan5N46CNUWYH2WR2g3OW2WI1rmK86XvCbt+nVoeD Ch53GDo/Y1cXHzcRj2N4Ob3yrB6NFxvbJHwJyV2345H7skeR0Kn1tJCDSNDqJZcCIP7mpp p+pYX9L+7EntuByzP5GLUCWi8z6QULkb4f5VuBU3c3NhhFNgg6OHc6lq9Ppoq3089Fz8xB /CTir/qeSqSlj3R8vCX56xk5iXDx2TrXoyuA4Vd/6LeitfdEopdibAQ66jf2nAlRFyp07S GEXYzU3v6HoIOWx+1KMsqHhUyBAuYMcsPJuYb4m8MgiYE6E+TG6gNBfdDAVtYQ== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1761164127; a=rsa-sha256; cv=none; b=wnIQGriag+1PRR6a1885dUhb5ZCitLRtxVcO/tphRA6ht9DjiWXPaV1x8JcGlIRC3wCphI hcpABd4V1NMhhjcv0ACS3faDqScfaAYf0YPQd60ZDIHaS1qfuV6+sgbcvJ6GgTEbQjjUmW XWrP2gvNnqE+BykKKy7OVpXCc19V3fT3IfsQ2rjj5WBvo5h9cvYxM2q9eGPSkIXK+l1+u2 WiLT/kfk68x7ZkaT+xSgS9Eala2Gm6qazAHkfJE111ekAIHB6w/wIHHYdb0zpQuYxPu16B 6JttO9PHjjVJuKTwg78i1sOiFBoQM0jod9dKA8+IYt+MVwVimVCaue5yRtWZFg== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4csL4v1tN2zkqX; Wed, 22 Oct 2025 20:15:27 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.18.1/8.18.1) with ESMTP id 59MKFRap033120; Wed, 22 Oct 2025 20:15:27 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.18.1/8.18.1/Submit) id 59MKFR5U033117; Wed, 22 Oct 2025 20:15:27 GMT (envelope-from git) Date: Wed, 22 Oct 2025 20:15:27 GMT Message-Id: <202510222015.59MKFR5U033117@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-branches@FreeBSD.org From: Colin Percival Subject: git: b1faa50c18e8 - releng/15.0 - imgact_elf: Check note body sizes List-Id: Commits to the stable branches of the FreeBSD src repository List-Archive: https://lists.freebsd.org/archives/dev-commits-src-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: dev-commits-src-branches@freebsd.org Sender: owner-dev-commits-src-branches@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cperciva X-Git-Repository: src X-Git-Refname: refs/heads/releng/15.0 X-Git-Reftype: branch X-Git-Commit: b1faa50c18e8f65a43c7fb4c4170a9ff47706805 Auto-Submitted: auto-generated The branch releng/15.0 has been updated by cperciva: URL: https://cgit.FreeBSD.org/src/commit/?id=b1faa50c18e8f65a43c7fb4c4170a9ff47706805 commit b1faa50c18e8f65a43c7fb4c4170a9ff47706805 Author: Mark Johnston AuthorDate: 2025-10-15 20:14:36 +0000 Commit: Colin Percival CommitDate: 2025-10-22 20:12:27 +0000 imgact_elf: Check note body sizes In parse_notes we validate that the note name fits within the note buffer, but we do not do the same for the note data, so there is some potential for an OOB read in the note handler. Add a bounds check. Approved by: re (cperciva) Reported by: Ilja Van Sprundel Reviewed by: kib, emaste MFC after: 1 week Differential Revision: https://reviews.freebsd.org/D53063 (cherry picked from commit c86af2cc4cd12fb0174843b22d737c3b5b5d55d0) (cherry picked from commit 09ae918e1f00572f9045283c281cf2d210ece491) --- sys/kern/imgact_elf.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c index 1bc2491a1a12..bc4fcad6c61b 100644 --- a/sys/kern/imgact_elf.c +++ b/sys/kern/imgact_elf.c @@ -2831,7 +2831,7 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote, } if ((const char *)note_end - (const char *)note < sizeof(Elf_Note)) { - uprintf("ELF note to short\n"); + uprintf("ELF note too short\n"); goto retf; } if (note->n_namesz != checknote->n_namesz || @@ -2839,9 +2839,9 @@ __elfN(parse_notes)(const struct image_params *imgp, const Elf_Note *checknote, note->n_type != checknote->n_type) goto nextnote; note_name = (const char *)(note + 1); - if (note_name + checknote->n_namesz >= - (const char *)note_end || strncmp(note_vendor, - note_name, checknote->n_namesz) != 0) + if (note_name + roundup2(note->n_namesz, ELF_NOTE_ROUNDSIZE) + + note->n_descsz >= (const char *)note_end || + strncmp(note_vendor, note_name, checknote->n_namesz) != 0) goto nextnote; if (cb(note, cb_arg, &res))