Skip to contentSkip to conversation

syscalls/timer_create: Add test for CVE-2017-18344

PATCH New Christian Amann 3 participants 3 messages Jul 26, 2019 – Jul 29, 2019

lore
Share & tools
lore
#0 lore raw

PATCH v2 1/1 syscalls/timer_create: Add test for CVE-2017-18344

In kernels prior to 4.14.8 (missing commit cef31d9af908) the sigevent.sigev_notify field is not properly checked when creating a timer using timer_create(2). This can be used to read arbitrary kernel memory.

---

Notes:
Patch aplicable after the timer tests got moved to syscalls (see patch on the mailing list).

 runtest/syscalls                                   |  1 +
 testcases/kernel/syscalls/timer_create/.gitignore  |  1 +
 .../kernel/syscalls/timer_create/timer_create03.c  | 67 ++++++++++++++++++++++
 3 files changed, 69 insertions(+)
 create mode 100644 testcases/kernel/syscalls/timer_create/timer_create03.c
runtest/syscalls +1 -0
index 79a6a0bb6..e2499eed7 100644
@@ -1441,6 +1441,7 @@ timerfd_settime01 timerfd_settime01
 
 timer_create01 timer_create01
 timer_create02 timer_create02
+timer_create03 timer_create03
 
 timer_delete01 timer_delete01
 timer_delete02 timer_delete02
testcases/kernel/syscalls/timer_create/.gitignore +1 -0
index 5fd2c303e..b70d6cb02 100644
@@ -1,2 +1,3 @@
 /timer_create01
 /timer_create02
+/timer_create03
testcases/kernel/syscalls/timer_create/timer_create03.c new file +67 -0

67 lines not on this page · raw message

Signature · 1 line
2.16.4
#1 lore raw

PATCH v2 1/1 syscalls/timer_create: Add test for CVE-2017-18344

Quoted 7 lines · Christian Amann

In kernels prior to 4.14.8 (missing commit cef31d9af908) the sigevent.sigev_notify field is not properly checked when creating a timer using timer_create(2). This can be used to read arbitrary kernel memory.

Signature · 2 lines
Regards,
Li Wang
#2 lore raw

PATCH v2 1/1 syscalls/timer_create: Add test for CVE-2017-18344

In reply to Christian Amann

Hi Christian,

Quoted 4 lines

In kernels prior to 4.14.8 (missing commit cef31d9af908) the sigevent.sigev_notify field is not properly checked when creating a timer using timer_create(2). This can be used to read arbitrary kernel memory.

Thanks for your patch, merged into master (with Cyril's and Li's ack).

Kind regards,
Petr