Hi,
it is possible to overflow uint64_t by summing variables offset and
size up in elf_get_section_info. Thee values are extracted from module
file and are possibly maliciously tampered with.
If offset is in valid range and size very large, the result will
overflow and the size check passes. Later on, this will most likely
lead to a segmentation fault due to accessing uninitialized memory.
Attached please find a proof of concept module, which will trigger
a segmentation fault on modinfo. Tested on amd64:
tobias:~$ modinfo poc.ko
filename: /home/tobias/poc.ko
Segmentation fault
Tobias
PS: There are more errors of this type in the ELF handling code, so let
me know if you are okay with the additional check in the if-block.
I will send patches like this one for the other occurrences then.
---
libkmod/libkmod-elf.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/libkmod/libkmod-elf.c b/libkmod/libkmod-elf.c
index d1b0f33..8a8a73d 100644
--- a/libkmod/libkmod-elf.c
+++ b/libkmod/libkmod-elf.c
@@ -251,7 +251,7 @@ static inline int elf_get_section_info(const struct kmod_elf *elf, uint16_t idx,
#undef READV
min_size = *offset + *size;
- if (min_size > elf->size) {
+ if (ULLONG_MAX - *offset < *size || min_size > elf->size) {
ELFDBG(elf, "out-of-bounds: %"PRIu64" >= %"PRIu64" (ELF size)\n",
min_size, elf->size);
return -EINVAL;
--
2.3.0
Attachment:
poc.ko
Description: Binary data
