Fixes: a5061d028 ("firmware: google: memconsole: Adapt to new coreboot
ring buffer format")On Sat, May 20, 2017 at 1:32 AM, Greg Kroah-Hartman <gre...@linuxfoundation.org> wrote: > On Fri, May 19, 2017 at 02:44:38PM -0700, Julius Werner wrote: >> The recent coreboot memory console update (firmware: google: memconsole: >> Adapt to new coreboot ring buffer format) introduced a small security >> issue in the driver: The new driver implementation parses the memory >> console structure again on every access. This is intentional so that >> additional lines added concurrently by runtime firmware can be read out. >> >> However, if an attacker can write to the structure, they could increase >> the size value to a point where the driver would read potentially >> sensitive memory areas from outside the original console buffer during >> the next access. This can be done through /dev/mem, since the console >> buffer usually resides in firmware-reserved memory that is not covered >> by STRICT_DEVMEM. >> >> This patch resolves that problem by reading the buffer's size value only >> once during boot (where we can still trust the structure). Other parts >> of the structure can still be modified at runtime, but the driver's >> bounds checks make sure that it will never read outside the buffer. >> >> Signed-off-by: Julius Werner <jwer...@chromium.org> > > Care to provide a "Fixes: SHA" type line here saying what commit this > fixes the issue for, to allow people to know what is going on. > > thanks, > > greg k-h
