oss-security - Linux Kernel: out of bounds array access in dm-ioctl.c

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+-U7QC-zxn_XYLJifSm=cDmsW0_Rs+juQuoCUTw1+TQmdfpGg@mail.gmail.com>
Date: Sun, 28 Mar 2021 11:47:22 +0800
From: - Nop <nopitydays@...il.com>
To: oss-security@...ts.openwall.com
Subject: Linux Kernel: out of bounds array access in dm-ioctl.c

Hi,

We found an out of bounds array accessing bug in drivers/md/dm-ioctl.c, and
reproduced it in the latest kernel (v5.11.10).

The root cause of this BUG is :

The field "data_size" in function ctl_ioctl is fully controlled by users
and this argument controls the size of kvmalloc in function copy_params.

When the data_size is in a range of [0x131,0x138], the allocated memory
which is pointed by the variable "param" used in ioctl
"DM_LIST_DEVICES_CMD" is too small, causing an oob bug at line "nl->dev =
0; /* Flags no data */" (
https://github.com/torvalds/linux/blob/0d02ec6b3136c73c09e7859f0d0e4e2c4c07b49b/drivers/md/dm-ioctl.c#L538
)

Attachments are the poc, kernel config and Kernel report.

The patch:
https://github.com/torvalds/linux/commit/4edbe1d7bcffcd6269f3b5eb63f710393ff2ec7a
     * Grab our output buffer.
     */
     nl = orig_nl = get_result_buffer(param, param_size, &len);
-    if (len < needed) {
+    if (len < needed || len < sizeof(nl->dev)) {
         param->flags |= DM_BUFFER_FULL_FLAG;
         goto out;
     }

Regards,
Bodong Zhao of NISL lab, Tsinghua University

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.