From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY, SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED,USER_AGENT_GIT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A4DD0FA3728 for ; Wed, 16 Oct 2019 22:00:32 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 79B8F20872 for ; Wed, 16 Oct 2019 22:00:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1571263232; bh=K5yb8dbyG3rknn0iUfjQOz9VplQrDY1Y/nQQHL4cefE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:List-ID:From; b=y2EkFZl99rr+V3/fouYL2lejWZIBSSi0ZzquhqnL5hlpVWwxp5rR64z6D0ZaFs3mT i4j1xD8zK6yFFItECfywk5nfpz3Pel2QbL6G2cfHuTRTKp9T+9P0FPk1R4gK/FBf5d c2KuvSVjX+12arHAchoB32Fw16qX+ChanN0E+1mE= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S2438796AbfJPWAb (ORCPT ); Wed, 16 Oct 2019 18:00:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:53982 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S2438474AbfJPV7U (ORCPT ); Wed, 16 Oct 2019 17:59:20 -0400 Received: from localhost (unknown [192.55.54.58]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 7F41D20872; Wed, 16 Oct 2019 21:59:19 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1571263159; bh=K5yb8dbyG3rknn0iUfjQOz9VplQrDY1Y/nQQHL4cefE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CPNf/XtLjIPYjwRsFbAerEZeqDpqHfyfRCv3uO5YA5os3bePp13YvEi6TGnPQzSPR 4GEc9zOBxyfTC31yIGYOxie4vsnjfsWejDg4lQhKg2DUXKz9INOHgSdKYzF59wRUZz 6plFg/0PewbWtYdSaHRsnott+V6nozMjeNEnRRd4= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Milos Malik , Ondrej Mosnacek , Stephen Smalley , Paul Moore Subject: [PATCH 5.3 070/112] selinux: fix context string corruption in convert_context() Date: Wed, 16 Oct 2019 14:51:02 -0700 Message-Id: <20191016214903.275204395@linuxfoundation.org> X-Mailer: git-send-email 2.23.0 In-Reply-To: <20191016214844.038848564@linuxfoundation.org> References: <20191016214844.038848564@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Ondrej Mosnacek commit 2a5243937c700ffe6a28e6557a4562a9ab0a17a4 upstream. string_to_context_struct() may garble the context string, so we need to copy back the contents again from the old context struct to avoid storing the corrupted context. Since string_to_context_struct() tokenizes (and therefore truncates) the context string and we are later potentially copying it with kstrdup(), this may eventually cause pieces of uninitialized kernel memory to be disclosed to userspace (when copying to userspace based on the stored length and not the null character). How to reproduce on Fedora and similar: # dnf install -y memcached # systemctl start memcached # semodule -d memcached # load_policy # load_policy # systemctl stop memcached # ausearch -m AVC type=AVC msg=audit(1570090572.648:313): avc: denied { signal } for pid=1 comm="systemd" scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=process permissive=0 trawcon=73797374656D5F75007400000000000070BE6E847296FFFF726F6D000096FFFF76 Cc: stable@vger.kernel.org Reported-by: Milos Malik Fixes: ee1a84fdfeed ("selinux: overhaul sidtab to fix bug and improve performance") Signed-off-by: Ondrej Mosnacek Acked-by: Stephen Smalley Signed-off-by: Paul Moore Signed-off-by: Greg Kroah-Hartman --- security/selinux/ss/services.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) --- a/security/selinux/ss/services.c +++ b/security/selinux/ss/services.c @@ -1946,7 +1946,14 @@ static int convert_context(struct contex rc = string_to_context_struct(args->newp, NULL, s, newc, SECSID_NULL); if (rc == -EINVAL) { - /* Retain string representation for later mapping. */ + /* + * Retain string representation for later mapping. + * + * IMPORTANT: We need to copy the contents of oldc->str + * back into s again because string_to_context_struct() + * may have garbled it. + */ + memcpy(s, oldc->str, oldc->len); context_init(newc); newc->str = s; newc->len = oldc->len;