svn commit: r338604 - stable/11/sys/kern
Gordon Tetlow
gordon at FreeBSD.org
Wed Sep 12 05:02:12 UTC 2018
Author: gordon
Date: Wed Sep 12 05:02:11 2018
New Revision: 338604
URL: https://svnweb.freebsd.org/changeset/base/338604
Log:
MFC 338603:
Correct ELF header parsing code to prevent invalid ELF sections from
disclosing memory.
Submitted by: markj
Reported by: Thomas Barabosch, Fraunhofer FKIE
Approved by: so
Security: FreeBSD-SA-18:12.elf
Security: CVE-2018-6924
Sponsored by: The FreeBSD Foundation
Modified:
stable/11/sys/kern/imgact_elf.c
stable/11/sys/kern/vfs_vnops.c
Directory Properties:
stable/11/ (props changed)
Modified: stable/11/sys/kern/imgact_elf.c
==============================================================================
--- stable/11/sys/kern/imgact_elf.c Wed Sep 12 04:57:34 2018 (r338603)
+++ stable/11/sys/kern/imgact_elf.c Wed Sep 12 05:02:11 2018 (r338604)
@@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
break;
case PT_INTERP:
/* Path to interpreter */
- if (phdr[i].p_filesz > MAXPATHLEN) {
+ if (phdr[i].p_filesz < 2 ||
+ phdr[i].p_filesz > MAXPATHLEN) {
uprintf("Invalid PT_INTERP\n");
error = ENOEXEC;
goto ret;
@@ -870,6 +871,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i
} else {
interp = __DECONST(char *, imgp->image_header) +
phdr[i].p_offset;
+ if (interp[interp_name_len - 1] != '\0') {
+ uprintf("Invalid PT_INTERP\n");
+ error = ENOEXEC;
+ goto ret;
+ }
}
break;
case PT_GNU_STACK:
Modified: stable/11/sys/kern/vfs_vnops.c
==============================================================================
--- stable/11/sys/kern/vfs_vnops.c Wed Sep 12 04:57:34 2018 (r338603)
+++ stable/11/sys/kern/vfs_vnops.c Wed Sep 12 05:02:11 2018 (r338604)
@@ -528,6 +528,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base,
struct vn_io_fault_args args;
int error, lock_flags;
+ if (offset < 0 && vp->v_type != VCHR)
+ return (EINVAL);
auio.uio_iov = &aiov;
auio.uio_iovcnt = 1;
aiov.iov_base = base;
More information about the svn-src-all
mailing list