d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix the length calculation for the final block of a sendfile(2)

Browse Source 
transmission which could be tricked into rounding up to the nearest
page size, leaking up to a page of kernel memory.  [13:11]

In IPv6 and NetATM, stop SIOCSIFADDR, SIOCSIFBRDADDR, SIOCSIFDSTADDR
and SIOCSIFNETMASK at the socket layer rather than pass them on to the
link layer without validation or credential checks.  [SA-13:12]

Prevent cross-mount hardlinks between different nullfs mounts of the
same underlying filesystem.  [SA-13:13]

Security:	CVE-2013-5666
Security:	FreeBSD-SA-13:11.sendfile
Security:	CVE-2013-5691
Security:	FreeBSD-SA-13:12.ifioctl
Security:	CVE-2013-5710
Security:	FreeBSD-SA-13:13.nullfs
Approved by:	re
This commit is contained in:
Dag-Erling Smørgrav 2013-09-10 10:05:59 +00:00
parent 9dc29a3cf0
commit 1a05c762b9
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=255442
5 changed files with 57 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
sys/fs/nullfs/null_vnops.c
View File

@ -858,6 +858,15 @@ null_vptocnp(struct vop_vptocnp_args *ap)
return (error);
}
static int
null_link(struct vop_link_args *ap)
{
if (ap->a_tdvp->v_mount != ap->a_vp->v_mount)
return (EXDEV);
return (null_bypass((struct vop_generic_args *)ap));
}
/*
* Global vfs data structures
*/
@ -871,6 +880,7 @@ struct vop_vector null_vnodeops = {
.vop_getwritemount = null_getwritemount,
.vop_inactive = null_inactive,
.vop_islocked = vop_stdislocked,
.vop_link = null_link,
.vop_lock1 = null_lock,
.vop_lookup = null_lookup,
.vop_open = null_open,

9
sys/kern/uipc_syscalls.c
View File

@ -2221,11 +2221,10 @@ vn_sendfile(struct file *fp, int sockfd, struct uio *hdr_uio,
* or the passed in nbytes.
*/
pgoff = (vm_offset_t)(off & PAGE_MASK);
if (nbytes)
rem = (nbytes - fsbytes - loopbytes);
else
rem = va.va_size -
offset - fsbytes - loopbytes;
rem = va.va_size - offset;
if (nbytes != 0)
rem = omin(rem, nbytes);
rem -= fsbytes + loopbytes;
xfsize = omin(PAGE_SIZE - pgoff, rem);
xfsize = omin(space - loopbytes, xfsize);
if (xfsize <= 0) {

18
sys/net/if.c
View File

@ -2553,11 +2553,23 @@ ifioctl(struct socket *so, u_long cmd, caddr_t data, struct thread *td)
CURVNET_RESTORE();
return (EOPNOTSUPP);
}
/*
* Pass the request on to the socket control method, and if the
* latter returns EOPNOTSUPP, directly to the interface.
*
* Make an exception for the legacy SIOCSIF* requests. Drivers
* trust SIOCSIFADDR et al to come from an already privileged
* layer, and do not perform any credentials checks or input
* validation.
*/
#ifndef COMPAT_43
error = ((*so->so_proto->pr_usrreqs->pru_control)(so, cmd,
data,
ifp, td));
if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL)
if (error == EOPNOTSUPP && ifp != NULL && ifp->if_ioctl != NULL &&
cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR &&
cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK)
error = (*ifp->if_ioctl)(ifp, cmd, data);
#else
{
@ -2601,7 +2613,9 @@ ifioctl(struct socket *so, u_long cmd, caddr_t data, struct thread *td)
data,
ifp, td));
if (error == EOPNOTSUPP && ifp != NULL &&
ifp->if_ioctl != NULL)
ifp->if_ioctl != NULL &&
cmd != SIOCSIFADDR && cmd != SIOCSIFBRDADDR &&
cmd != SIOCSIFDSTADDR && cmd != SIOCSIFNETMASK)
error = (*ifp->if_ioctl)(ifp, cmd, data);
switch (ocmd) {

12
sys/netinet6/in6.c
View File

@ -431,6 +431,18 @@ in6_control(struct socket *so, u_long cmd, caddr_t data,
case SIOCGIFSTAT_ICMP6:
sa6 = &ifr->ifr_addr;
break;
case SIOCSIFADDR:
case SIOCSIFBRDADDR:
case SIOCSIFDSTADDR:
case SIOCSIFNETMASK:
/*
* Although we should pass any non-INET6 ioctl requests
* down to driver, we filter some legacy INET requests.
* Drivers trust SIOCSIFADDR et al to come from an already
* privileged layer, and do not perform any credentials
* checks or input validation.
*/
return (EINVAL);
default:
sa6 = NULL;
break;

15
sys/netnatm/natm.c
View File

@ -339,6 +339,21 @@ natm_usr_control(struct socket *so, u_long cmd, caddr_t arg,
npcb = (struct natmpcb *)so->so_pcb;
KASSERT(npcb != NULL, ("natm_usr_control: npcb == NULL"));
switch (cmd) {
case SIOCSIFADDR:
case SIOCSIFBRDADDR:
case SIOCSIFDSTADDR:
case SIOCSIFNETMASK:
/*
* Although we should pass any non-ATM ioctl requests
* down to driver, we filter some legacy INET requests.
* Drivers trust SIOCSIFADDR et al to come from an already
* privileged layer, and do not perform any credentials
* checks or input validation.
*/
return (EINVAL);
}
if (ifp == NULL || ifp->if_ioctl == NULL)
return (EOPNOTSUPP);
return ((*ifp->if_ioctl)(ifp, cmd, arg));