From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755540AbdETIck (ORCPT ); Sat, 20 May 2017 04:32:40 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:45746 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753708AbdETIce (ORCPT ); Sat, 20 May 2017 04:32:34 -0400 Date: Sat, 20 May 2017 10:32:23 +0200 From: Greg Kroah-Hartman To: Julius Werner Cc: linux-kernel@vger.kernel.org, Aaron Durbin Subject: Re: [PATCH] firmware: google: memconsole: Prevent overrun attack on coreboot console Message-ID: <20170520083223.GB3460@kroah.com> References: <20170519214438.18398-1-jwerner@chromium.org> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170519214438.18398-1-jwerner@chromium.org> User-Agent: Mutt/1.8.2 (2017-04-18) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, May 19, 2017 at 02:44:38PM -0700, Julius Werner wrote: > The recent coreboot memory console update (firmware: google: memconsole: > Adapt to new coreboot ring buffer format) introduced a small security > issue in the driver: The new driver implementation parses the memory > console structure again on every access. This is intentional so that > additional lines added concurrently by runtime firmware can be read out. > > However, if an attacker can write to the structure, they could increase > the size value to a point where the driver would read potentially > sensitive memory areas from outside the original console buffer during > the next access. This can be done through /dev/mem, since the console > buffer usually resides in firmware-reserved memory that is not covered > by STRICT_DEVMEM. > > This patch resolves that problem by reading the buffer's size value only > once during boot (where we can still trust the structure). Other parts > of the structure can still be modified at runtime, but the driver's > bounds checks make sure that it will never read outside the buffer. > > Signed-off-by: Julius Werner Care to provide a "Fixes: SHA" type line here saying what commit this fixes the issue for, to allow people to know what is going on. thanks, greg k-h