[PATCH] sgi-gru: Fix kernel stack buffer overrun

[PATCH] sgi-gru: Fix kernel stack buffer overrun

[Michael Buesch]

This patch fixes a kernel stack buffer overrun in the sgi-gru procfs
interface implementation.
The "count" parameter to options_write() is user controlled. So this bug
can be used to write '\0' bytes to almost arbitrary places on the kernel stack.

Signed-off-by: Michael Buesch <mb@bu3sch.de>
Cc: stable@kernel.org

---

This procfs file has 0644 permissions, so the bug is probably not exploitable
for local privilege escalation.

---
 drivers/misc/sgi-gru/gruprocfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- linux-2.6.orig/drivers/misc/sgi-gru/gruprocfs.c
+++ linux-2.6/drivers/misc/sgi-gru/gruprocfs.c
@@ -157,23 +157,23 @@ static int options_show(struct seq_file 
 	seq_printf(s, "0x%lx\n", gru_options);
 	return 0;
 }
 
 static ssize_t options_write(struct file *file, const char __user *userbuf,
 			     size_t count, loff_t *data)
 {
 	unsigned long val;
 	char buf[80];
 
+	memset(buf, 0, sizeof(buf));
 	if (strncpy_from_user(buf, userbuf, sizeof(buf) - 1) < 0)
 		return -EFAULT;
-	buf[count - 1] = '\0';
 	if (!strict_strtoul(buf, 10, &val))
 		gru_options = val;
 
 	return count;
 }
 
 static int cch_seq_show(struct seq_file *file, void *data)
 {
 	long gid = *(long *)data;
 	int i;

-- 
Greetings, Michael.

Re: [PATCH] sgi-gru: Fix kernel stack buffer overrun

[Jack Steiner]

On Tue, Jul 21, 2009 at 12:08:38AM +0200, Michael Buesch wrote:
> This patch fixes a kernel stack buffer overrun in the sgi-gru procfs
> interface implementation.
> The "count" parameter to options_write() is user controlled. So this bug
> can be used to write '\0' bytes to almost arbitrary places on the kernel stack.
> 
> Signed-off-by: Michael Buesch <mb@bu3sch.de>
> Cc: stable@kernel.org

Acked-by: Jack Steiner <steiner@sgi.com>


Thanks...

--- jack