[Bug 206551] Integer overflow in iconv kernel module

[bugzilla-noreply at freebsd.org]

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=206551

            Bug ID: 206551
           Summary: Integer overflow in iconv kernel module
           Product: Base System
           Version: 11.0-CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: ertl.chris at gmail.com

After loading the iconv kernel module, a new sysctl name, "kern.iconv.add" is
accessible for `root` user.

This is handled with the following code:

    static int
    iconv_sysctl_add(SYSCTL_HANDLER_ARGS)
    {
        ...
        if (din.ia_datalen > ICONV_CSMAXDATALEN)
            return EINVAL;
        ...
        if (din.ia_datalen) {
            csp->cp_data = malloc(din.ia_datalen, M_ICONVDATA, M_WAITOK);
            error = copyin(din.ia_data, csp->cp_data, din.ia_datalen);
            if (error)
                goto bad;
        }
        ...
    }

Since the `ia_datalen` member of `struct iconv_add_in` is signed:

    struct iconv_add_in {
        int     ia_version;
        char    ia_converter[ICONV_CNVNMAXLEN];
        char    ia_to[ICONV_CSNMAXLEN];
        char    ia_from[ICONV_CSNMAXLEN];
        int     ia_datalen;
        const void *ia_data;
    };

The check on user supplied `din.ia_datalen` is insufficient. If a negative
value is passed, it will bypass the check, and then wraparound to a huge value
when converted to an `unsigned` type to be passed to `malloc` and `copyin`. For
example, passing `-1` will bypass the check, and then attempt to allocate and
copy to a buffer of size `0xffffffff`.

The impact of this is low, since it is only triggerable as `root`, and could at
most result in DoS.

The solution is to replace this check:

    if (din.ia_datalen > ICONV_CSMAXDATALEN)

With this:

    if (din.ia_datalen > ICONV_CSMAXDATALEN || din.ia_datalen < 0)

-- 
You are receiving this mail because:
You are the assignee for the bug.