From mboxrd@z Thu Jan 1 00:00:00 1970 From: Kees Cook Subject: [PATCH] isdn: Disable IIOCDBGVAR Date: Wed, 15 Aug 2018 12:14:05 -0700 Message-ID: <20180815191405.GA29528@beast> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: Al Viro , Karsten Keil , linux-kernel@vger.kernel.org, netdev@vger.kernel.org To: "David S. Miller" Return-path: Received: from mail-pg1-f193.google.com ([209.85.215.193]:45623 "EHLO mail-pg1-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727408AbeHOWHc (ORCPT ); Wed, 15 Aug 2018 18:07:32 -0400 Received: by mail-pg1-f193.google.com with SMTP id f1-v6so893231pgq.12 for ; Wed, 15 Aug 2018 12:14:07 -0700 (PDT) Content-Disposition: inline Sender: netdev-owner@vger.kernel.org List-ID: It was possible to directly leak the kernel address where the isdn_dev structure pointer was stored. This is a kernel ASLR bypass for anyone with access to the ioctl. The code had been present since the beginning of git history, though this shouldn't ever be needed for normal operation, therefore remove it. Reported-by: Al Viro Cc: Karsten Keil Signed-off-by: Kees Cook --- netdev doesn't like explict stable markings, so I'll just ask here that it get included in -stable please. :) --- drivers/isdn/i4l/isdn_common.c | 8 +------- 1 file changed, 1 insertion(+), 7 deletions(-) diff --git a/drivers/isdn/i4l/isdn_common.c b/drivers/isdn/i4l/isdn_common.c index 7a501dbe7123..6a5b3f00f9ad 100644 --- a/drivers/isdn/i4l/isdn_common.c +++ b/drivers/isdn/i4l/isdn_common.c @@ -1640,13 +1640,7 @@ isdn_ioctl(struct file *file, uint cmd, ulong arg) } else return -EINVAL; case IIOCDBGVAR: - if (arg) { - if (copy_to_user(argp, &dev, sizeof(ulong))) - return -EFAULT; - return 0; - } else - return -EINVAL; - break; + return -EINVAL; default: if ((cmd & IIOCDRVCTL) == IIOCDRVCTL) cmd = ((cmd >> _IOC_NRSHIFT) & _IOC_NRMASK) & ISDN_DRVIOCTL_MASK; -- 2.17.1 -- Kees Cook Pixel Security