On Tue, May 21, 2024 at 05:31:59PM +0200, Greg Kroah-Hartman wrote:
> kernel: kexec: copy user-array safely
>
> Currently, there is no overflow-check with memdup_user().
This is false.
Therefore, I'd like to dispute this CVE.
The overflow check is in the kexec_load_check()
function called shortly before the memdup_user() call:
SYSCALL_DEFINE4(kexec_load, unsigned long, entry, unsigned long, nr_segments,
struct kexec_segment __user *, segments, unsigned long, flags)
{
result = kexec_load_check(nr_segments, flags);
if (result)
return result;
...
ksegments = memdup_user(segments, nr_segments * sizeof(ksegments[0]));
...
}
#define KEXEC_SEGMENT_MAX 16
static inline int kexec_load_check(unsigned long nr_segments,
unsigned long flags)
{
...
if (nr_segments > KEXEC_SEGMENT_MAX)
return -EINVAL;
}
Thanks,
--
Jiri Bohac <jbohac@xxxxxxx>
SUSE Labs, Prague, Czechia
_______________________________________________
kexec mailing list
kexec@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/kexec
