redonkable
/
alistair23-linux
1
0
Fork 0
Code Releases Activity

lib/syscall: fix syscall registers retrieval on 32-bit platforms 

commit 4f134b89a2 upstream.

Lilith >_> and Claudio Bozzato of Cisco Talos security team reported
that collect_syscall() improperly casts the syscall registers to 64-bit
values leaking the uninitialized last 24 bytes on 32-bit platforms, that
are visible in /proc/self/syscall.

The cause is that info->data.args are u64 while syscall_get_arguments()
uses longs, as hinted by the bogus pointer cast in the function.

Let's just proceed like the other call places, by retrieving the
registers into an array of longs before assigning them to the caller's
array.  This was successfully tested on x86_64, i386 and ppc32.

Reference: CVE-2020-28588, TALOS-2020-1211
Fixes: 631b7abacd ("ptrace: Remove maxargs from task_current_syscall()")
Cc: Greg KH <greg@kroah.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Tested-by: Michael Ellerman <mpe@ellerman.id.au> (ppc32)
Signed-off-by: Willy Tarreau <w@1wt.eu>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
5.4-rM2-2.2.x-imx-squashed
Willy Tarreau 2020-11-30 08:36:48 +01:00 committed by Greg Kroah-Hartman
parent f68f5bdfef
commit 867fbf2bb7
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
lib/syscall.c
View File

@ -7,6 +7,7 @@
static int collect_syscall(struct task_struct *target, struct syscall_info *info)
{
unsigned long args[6] = { };
struct pt_regs *regs;
if (!try_get_task_stack(target)) {
@ -27,8 +28,14 @@ static int collect_syscall(struct task_struct *target, struct syscall_info *info
info->data.nr = syscall_get_nr(target, regs);
if (info->data.nr != -1L)
syscall_get_arguments(target, regs,
(unsigned long *)&info->data.args[0]);
syscall_get_arguments(target, regs, args);
info->data.args[0] = args[0];
info->data.args[1] = args[1];
info->data.args[2] = args[2];
info->data.args[3] = args[3];
info->data.args[4] = args[4];
info->data.args[5] = args[5];
put_task_stack(target);
return 0;