[PATCH] x86_32,entry: Do syscall exit work on badsys (CVE-2014-4508)

[PATCH] x86_32,entry: Do syscall exit work on badsys (CVE-2014-4508)

[Andy Lutomirski]

The bad syscall nr paths are their own incomprehensible route
through the entry control flow.  Rearrange them to work just like
syscalls that return -ENOSYS.

This fixes an OOPS in the audit code when fast-path auditing is
enabled and sysenter gets a bad syscall nr (CVE-2014-4508).

This has probably been broken since Linux 2.6.27:
af0575bba0 i386 syscall audit fast-path

Cc: stable@vger.kernel.org
Cc: Roland McGrath <roland@redhat.com>
Reported-by: Toralf Förster <toralf.foerster@gmx.de>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
---

I realize that the syscall audit fast path and badsys code, on 32-bit
x86 no less, is possibly one of the least fun things in the kernel to
review, but this is still a real security bug and should get fixed :(

So I'm cc-ing a bunch of people and maybe someone will review it.

 arch/x86/kernel/entry_32.S | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index a2a4f46..f4258a5 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -431,9 +431,10 @@ sysenter_past_esp:
 	jnz sysenter_audit
 sysenter_do_call:
 	cmpl $(NR_syscalls), %eax
-	jae syscall_badsys
+	jae sysenter_badsys
 	call *sys_call_table(,%eax,4)
 	movl %eax,PT_EAX(%esp)
+sysenter_after_call:
 	LOCKDEP_SYS_EXIT
 	DISABLE_INTERRUPTS(CLBR_ANY)
 	TRACE_IRQS_OFF
@@ -688,7 +689,12 @@ END(syscall_fault)
 
 syscall_badsys:
 	movl $-ENOSYS,PT_EAX(%esp)
-	jmp resume_userspace
+	jmp syscall_exit
+END(syscall_badsys)
+
+sysenter_badsys:
+	movl $-ENOSYS,PT_EAX(%esp)
+	jmp sysenter_after_call
 END(syscall_badsys)
 	CFI_ENDPROC
 /*
-- 
1.9.3

Re: [PATCH] x86_32,entry: Do syscall exit work on badsys (CVE-2014-4508)

[Borislav Petkov]

On Mon, Jun 23, 2014 at 02:22:15PM -0700, Andy Lutomirski wrote:
> The bad syscall nr paths are their own incomprehensible route
> through the entry control flow.  Rearrange them to work just like
> syscalls that return -ENOSYS.
> 
> This fixes an OOPS in the audit code when fast-path auditing is
> enabled and sysenter gets a bad syscall nr (CVE-2014-4508).
> 
> This has probably been broken since Linux 2.6.27:
> af0575bba0 i386 syscall audit fast-path
> 
> Cc: stable@vger.kernel.org
> Cc: Roland McGrath <roland@redhat.com>
> Reported-by: Toralf Förster <toralf.foerster@gmx.de>
> Signed-off-by: Andy Lutomirski <luto@amacapital.net>
> ---
> 
> I realize that the syscall audit fast path and badsys code, on 32-bit
> x86 no less, is possibly one of the least fun things in the kernel to
> review, but this is still a real security bug and should get fixed :(
> 
> So I'm cc-ing a bunch of people and maybe someone will review it.

Well, AFAICS, you're rerouting execution so that the audit stuff gets
properly "unwound" before returning to userspace. Which makes sense to
me.

Would it really work in all possible cases and isn't it causing any
other problems?

No friggin' idea - it would need extensive hammering to confirm it is ok
IMHO.

HTH.

-- 
Regards/Gruss,
    Boris.

Sent from a fat crate under my desk. Formatting is fine.
--

Re: [PATCH] x86_32,entry: Do syscall exit work on badsys (CVE-2014-4508)

[Andy Lutomirski]

On Tue, Jun 24, 2014 at 3:51 AM, Borislav Petkov <bp@alien8.de> wrote:
> On Mon, Jun 23, 2014 at 02:22:15PM -0700, Andy Lutomirski wrote:
>> The bad syscall nr paths are their own incomprehensible route
>> through the entry control flow.  Rearrange them to work just like
>> syscalls that return -ENOSYS.
>>
>> This fixes an OOPS in the audit code when fast-path auditing is
>> enabled and sysenter gets a bad syscall nr (CVE-2014-4508).
>>
>> This has probably been broken since Linux 2.6.27:
>> af0575bba0 i386 syscall audit fast-path
>>
>> Cc: stable@vger.kernel.org
>> Cc: Roland McGrath <roland@redhat.com>
>> Reported-by: Toralf Förster <toralf.foerster@gmx.de>
>> Signed-off-by: Andy Lutomirski <luto@amacapital.net>
>> ---
>>
>> I realize that the syscall audit fast path and badsys code, on 32-bit
>> x86 no less, is possibly one of the least fun things in the kernel to
>> review, but this is still a real security bug and should get fixed :(
>>
>> So I'm cc-ing a bunch of people and maybe someone will review it.
>
> Well, AFAICS, you're rerouting execution so that the audit stuff gets
> properly "unwound" before returning to userspace. Which makes sense to
> me.
>
> Would it really work in all possible cases and isn't it causing any
> other problems?
>
> No friggin' idea - it would need extensive hammering to confirm it is ok
> IMHO.
>
> HTH.

It confirms my sense that no one knows how to test this stuff :-/
It's pretty clear that no one has ever extensively hammered it.

I wonder how much could be effectively rewritten in C.  I'm thinking
of redoing most of the entry work in C, but that won't help here.

--Andy

Re: [PATCH] x86_32,entry: Do syscall exit work on badsys (CVE-2014-4508)

[Borislav Petkov]

On Tue, Jun 24, 2014 at 01:53:25PM -0700, Andy Lutomirski wrote:
> It confirms my sense that no one knows how to test this stuff :-/
> It's pretty clear that no one has ever extensively hammered it.

Someone might've known at some point but who knows who knew. :-)

> I wonder how much could be effectively rewritten in C. I'm thinking of
> redoing most of the entry work in C, but that won't help here.

Whatever you do, you'll have to do testing yourself, I'm afraid, here
too. And then, after the patch is long committed and forgotten, someone
would resurface complaining that it breaks some obscure use case.

Eeh, the sad life of a kernel developer. :-\

-- 
Regards/Gruss,
    Boris.

Sent from a fat crate under my desk. Formatting is fine.
--