Re: [PATCH v2] evm: fix TOCTOU heap OOB in protected xattr reads

[sashiko-bot@kernel.org]

> ima_eventinodexattrs_init_common() queries the total size of protected
> xattrs, allocates that amount, and calls evm_read_protected_xattrs()
> again to fill the buffer. This creates a TOCTOU window: if the
> protected xattr changes between the two calls to
> evm_read_protected_xattrs(), names and lengths are written without
> checking whether the data still fits in the target buffer. This can
> yield an OOB heap write that KASAN reports as:
> 
>   BUG: KASAN: slab-out-of-bounds in evm_read_protected_xattrs+0x15e/0x280
>   Write of size 20 at addr ffff888002c59bcd by task init/62
> 
> Reject fields that no longer fit in the target buffer. For xattr
> values, also check the length returned by the copy before accounting it.
> This also handles the case where a size of 0 is treated as a length
> query.
> 
> Fixes: 8314b6732ae4e ("ima: Define new template fields xattrnames, xattrlengths and xattrvalues")
> Cc: stable@vger.kernel.org
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261107230514.1108379-2-Jeremy.Jean@oss.cyber.gouv.fr?part=1