Re: [PATCH] getsockopt() early argument sanity checking

[daw@cs.berkeley.edu (David Wagner)]

Solar Designer  wrote:
>The patch makes getsockopt(2) sanity-check the value pointed to by
>the optlen argument early on.  This is a security hardening measure
>intended to prevent exploitation of certain potential vulnerabilities in
>socket type specific getsockopt() code on UP systems.

This looks broken to me.  It has a TOCTTOU (time-of-check-to-time-of-use)
vulnerability (i.e., race condition): you read the length value twice,
and assume that you will get the same value both times.  That assumption
is not valid.

It looks like it will be easy to bypass this check.  For instance,
think about what happens if an adversary stores the length field in a
mmaped region, for instance.  It should be easy for the value of that
length field to change between when it was first read and when it was
subsequently read.  I don't see how this provides any "hardening" if
the attacker knows how to read kernel source code.  Am I missing
something?