score: fix off-by-one index into syscall table

PATCH In review Dan Rosenberg 3 participants 4 messages Jan 6, 2012 – Jan 10, 2012

Share & tools

Dan Rosenberg

author

2012-01-06 13:28 UTC #0 lore raw

PATCH 1/1 score: fix off-by-one index into syscall table

If the provided system call number is equal to __NR_syscalls, the current check will pass and a function pointer just after the system call table may be called, since sys_call_table is an array with total size __NR_syscalls. Whether or not this is a security bug depends on what the compiler puts immediately after the system call table. It's likely that this won't do anything bad because there is an additional NULL check on the syscall entry, but if there happens to be a non-NULL value immediately after the system call table, this may result in local privilege escalation.

Signed-off-by Dan Rosenberg <[email protected]>

Cc [email protected]

---
 arch/score/kernel/entry.S |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

arch/score/kernel/entry.S +1 -1

index 577abba..83bb960 100644
@@ -408,7 +408,7 @@ ENTRY(handle_sys)
 	sw	r9, [r0, PT_EPC]
 
 	cmpi.c	r27, __NR_syscalls 	# check syscall number
-	bgtu	illegal_syscall
+	bgeu	illegal_syscall
 
 	slli	r8, r27, 2		# get syscall routine
 	la	r11, sys_call_table

Eugene Teo

2012-01-10 06:40 UTC #1 lore raw

Cc'ed [email protected]

ping

Quoted 32 lines · Dan Rosenberg

If the provided system call number is equal to __NR_syscalls, the current check will pass and a function pointer just after the system call table may be called, since sys_call_table is an array with total size __NR_syscalls. Whether or not this is a security bug depends on what the compiler puts immediately after the system call table. It's likely that this won't do anything bad because there is an additional NULL check on the syscall entry, but if there happens to be a non-NULL value immediately after the system call table, this may result in local privilege escalation.
Signed-off-by Dan Rosenberg <[email protected]>
Cc [email protected]
Cc [email protected]
---
arch/score/kernel/entry.S | 2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
arch/score/kernel/entry.S +0 -0
index 577abba..83bb960 100644
@@ -408,7 +408,7 @@ ENTRY(handle_sys)
sw r9, [r0, PT_EPC]
cmpi.c r27, __NR_syscalls # check syscall number
- bgtu illegal_syscall
+ bgeu illegal_syscall
slli r8, r27, 2 # get syscall routine la r11, sys_call_table

Eugene Teo

2012-01-10 06:55 UTC #2 lore raw

Quoted 3 lines · Eugene Teo

Cc'ed [email protected]
ping

Liqin's work email bounced. I'm not sure if he is working on these anymore. If not, the MAINTAINERS file needs to be updated.

Quoted 33 lines · Dan Rosenberg

Quoted 32 lines
If the provided system call number is equal to __NR_syscalls, the current check will pass and a function pointer just after the system call table may be called, since sys_call_table is an array with total size __NR_syscalls. Whether or not this is a security bug depends on what the compiler puts immediately after the system call table. It's likely that this won't do anything bad because there is an additional NULL check on the syscall entry, but if there happens to be a non-NULL value immediately after the system call table, this may result in local privilege escalation.
Signed-off-by Dan Rosenberg <[email protected]>
Cc [email protected]
Cc [email protected]
---
arch/score/kernel/entry.S | 2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
arch/score/kernel/entry.S +0 -0
index 577abba..83bb960 100644
@@ -408,7 +408,7 @@ ENTRY(handle_sys)
sw r9, [r0, PT_EPC]
cmpi.c r27, __NR_syscalls # check syscall number
- bgtu illegal_syscall
+ bgeu illegal_syscall
slli r8, r27, 2 # get syscall routine la r11, sys_call_table

Lennox Wu

2012-01-10 16:10 UTC #3 lore raw

Dear all,
I will look the issue and update the informaion of MAINTAINERS. Best,
Lennox

2012/1/10 Eugene Teo <[email protected]>

Quoted 42 lines · Eugene Teo

Quoted 3 lines
Cc'ed [email protected]
ping
Liqin's work email bounced. I'm not sure if he is working on these anymore. If not, the MAINTAINERS file needs to be updated.
Quoted 33 lines · Dan Rosenberg
Quoted 32 lines
If the provided system call number is equal to __NR_syscalls, the current check will pass and a function pointer just after the system call table may be called, since sys_call_table is an array with total size __NR_syscalls. Whether or not this is a security bug depends on what the compiler puts immediately after the system call table. It's likely that this won't do anything bad because there is an additional NULL check on the syscall entry, but if there happens to be a non-NULL value immediately after the system call table, this may result in local privilege escalation.
Signed-off-by Dan Rosenberg <[email protected]>
Cc [email protected]
Cc [email protected]
---
arch/score/kernel/entry.S | 2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
arch/score/kernel/entry.S +0 -0
index 577abba..83bb960 100644
@@ -408,7 +408,7 @@ ENTRY(handle_sys)
sw r9, [r0, PT_EPC]
cmpi.c r27, __NR_syscalls # check syscall number
- bgtu illegal_syscall
+ bgeu illegal_syscall
slli r8, r27, 2 # get syscall routine la r11, sys_call_table