From: Jann Horn <jann@xxxxxxxxx>
Subject: swapfile: fix memory corruption via malformed swapfile
When root activates a swap partition whose header has the wrong endianness,
nr_badpages elements of badpages are swabbed before nr_badpages has been
checked, leading to a buffer overrun of up to 8GB.
This normally is not a security issue because it can only be exploited by
root (more specifically, a process with CAP_SYS_ADMIN or the ability to
modify a swap file/partition), and such a process can already e.g. modify
swapped-out memory of any other userspace process on the system.
Testcase for reproducing the bug (must be run as root, should crash your
kernel):
=================
#include <stdlib.h>
#include <unistd.h>
#include <sys/swap.h>
#include <limits.h>
#include <err.h>
#include <string.h>
#include <stdio.h>
#define PAGE_SIZE 4096
#define __u32 unsigned int
// from include/linux/swap.h
union swap_header {
struct {
char reserved[PAGE_SIZE - 10];
char magic[10]; /* SWAP-SPACE or SWAPSPACE2 */
} magic;
struct {
char bootbits[1024]; /* Space for disklabel etc. */
__u32 version;
__u32 last_page;
__u32 nr_badpages;
unsigned char sws_uuid[16];
unsigned char sws_volume[16];
__u32 padding[117];
__u32 badpages[1];
} info;
};
int main(void) {
char file[] = "/tmp/swapfile.XXXXXX";
int file_fd = mkstemp(file);
if (file_fd == -1)
err(1, "mkstemp");
if (ftruncate(file_fd, PAGE_SIZE))
err(1, "ftruncate");
union swap_header swap_header = {
.info = {
.version = __builtin_bswap32(1),
.nr_badpages = __builtin_bswap32(INT_MAX)
}
};
memcpy(swap_header.magic.magic, "SWAPSPACE2", 10);
if (write(file_fd, &swap_header, sizeof(swap_header)) !=
sizeof(swap_header))
err(1, "write");
// not because the attack needs it, just in case you forgot to
// sync yourself before crashing your machine
sync();
// now die
if (swapon(file, 0))
err(1, "swapon");
puts("huh, we survived");
if (swapoff(file))
err(1, "swapoff");
unlink(file);
}
=================
Link: http://lkml.kernel.org/r/1477949533-2509-1-git-send-email-jann@xxxxxxxxx
Signed-off-by: Jann Horn <jann@xxxxxxxxx>
Acked-by: Kees Cook <keescook@xxxxxxxxxxxx>
Acked-by: Jerome Marchand <jmarchan@xxxxxxxxxx>
Acked-by: Johannes Weiner <hannes@xxxxxxxxxxx>
Cc: "Kirill A. Shutemov" <kirill.shutemov@xxxxxxxxxxxxxxx>
Cc: Vlastimil Babka <vbabka@xxxxxxx>
Cc: Hugh Dickins <hughd@xxxxxxxxxx>
Cc: <stable@xxxxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
mm/swapfile.c | 2 ++
1 file changed, 2 insertions(+)
diff -puN mm/swapfile.c~swapfile-fix-memory-corruption-via-malformed-swapfile mm/swapfile.c
--- a/mm/swapfile.c~swapfile-fix-memory-corruption-via-malformed-swapfile
+++ a/mm/swapfile.c
@@ -2224,6 +2224,8 @@ static unsigned long read_swap_header(st
swab32s(&swap_header->info.version);
swab32s(&swap_header->info.last_page);
swab32s(&swap_header->info.nr_badpages);
+ if (swap_header->info.nr_badpages > MAX_SWAP_BADPAGES)
+ return 0;
for (i = 0; i < swap_header->info.nr_badpages; i++)
swab32s(&swap_header->info.badpages[i]);
}
_
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html