Author: gordon Date: Wed Sep 12 05:03:30 2018 New Revision: 338605 URL: https://svnweb.freebsd.org/changeset/base/338605
Log: MFC 338603: Correct ELF header parsing code to prevent invalid ELF sections from disclosing memory. Submitted by: markj Reported by: Thomas Barabosch, Fraunhofer FKIE Approved by: so Security: FreeBSD-SA-18:12.elf Security: CVE-2018-6924 Sponsored by: The FreeBSD Foundation Modified: stable/10/sys/kern/imgact_elf.c stable/10/sys/kern/vfs_vnops.c Directory Properties: stable/10/ (props changed) Modified: stable/10/sys/kern/imgact_elf.c ============================================================================== --- stable/10/sys/kern/imgact_elf.c Wed Sep 12 05:02:11 2018 (r338604) +++ stable/10/sys/kern/imgact_elf.c Wed Sep 12 05:03:30 2018 (r338605) @@ -795,7 +795,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -825,6 +826,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *i } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: Modified: stable/10/sys/kern/vfs_vnops.c ============================================================================== --- stable/10/sys/kern/vfs_vnops.c Wed Sep 12 05:02:11 2018 (r338604) +++ stable/10/sys/kern/vfs_vnops.c Wed Sep 12 05:03:30 2018 (r338605) @@ -510,6 +510,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base; _______________________________________________ svn-src-stable-10@freebsd.org mailing list https://lists.freebsd.org/mailman/listinfo/svn-src-stable-10 To unsubscribe, send any mail to "svn-src-stable-10-unsubscr...@freebsd.org"