d/freebsd-dev
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Properly bzero kldstat structure to prevent kernel information leak.

Browse Source 
Submitted by:	kib
Reported by:	TJ Corley
Security:	CVE-2017-1088
This commit is contained in:
Gordon Tetlow 2017-11-15 22:30:21 +00:00
parent 3e87bccde3
commit edb01d11f8
Notes: svn2git 2020-12-20 02:59:44 +00:00 
svn path=/head/; revision=325865
2 changed files with 25 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

31
sys/compat/freebsd32/freebsd32_misc.c
View File

@ -3331,8 +3331,8 @@ freebsd32_copyout_strings(struct image_params *imgp)
int
freebsd32_kldstat(struct thread *td, struct freebsd32_kldstat_args *uap)
{
struct kld_file_stat stat;
struct kld32_file_stat stat32;
struct kld_file_stat *stat;
struct kld32_file_stat *stat32;
int error, version;
if ((error = copyin(&uap->stat->version, &version, sizeof(version)))
@ -3342,17 +3342,22 @@ freebsd32_kldstat(struct thread *td, struct freebsd32_kldstat_args *uap)
version != sizeof(struct kld32_file_stat))
return (EINVAL);
error = kern_kldstat(td, uap->fileid, &stat);
if (error != 0)
return (error);
bcopy(&stat.name[0], &stat32.name[0], sizeof(stat.name));
CP(stat, stat32, refs);
CP(stat, stat32, id);
PTROUT_CP(stat, stat32, address);
CP(stat, stat32, size);
bcopy(&stat.pathname[0], &stat32.pathname[0], sizeof(stat.pathname));
return (copyout(&stat32, uap->stat, version));
stat = malloc(sizeof(*stat), M_TEMP, M_WAITOK | M_ZERO);
stat32 = malloc(sizeof(*stat32), M_TEMP, M_WAITOK | M_ZERO);
error = kern_kldstat(td, uap->fileid, stat);
if (error == 0) {
bcopy(&stat->name[0], &stat32->name[0], sizeof(stat->name));
CP(*stat, *stat32, refs);
CP(*stat, *stat32, id);
PTROUT_CP(*stat, *stat32, address);
CP(*stat, *stat32, size);
bcopy(&stat->pathname[0], &stat32->pathname[0],
sizeof(stat->pathname));
error = copyout(stat32, uap->stat, version);
}
free(stat, M_TEMP);
free(stat32, M_TEMP);
return (error);
}
int

12
sys/kern/kern_linker.c
View File

@ -1229,7 +1229,7 @@ sys_kldnext(struct thread *td, struct kldnext_args *uap)
int
sys_kldstat(struct thread *td, struct kldstat_args *uap)
{
struct kld_file_stat stat;
struct kld_file_stat *stat;
int error, version;
/*
@ -1242,10 +1242,12 @@ sys_kldstat(struct thread *td, struct kldstat_args *uap)
version != sizeof(struct kld_file_stat))
return (EINVAL);
error = kern_kldstat(td, uap->fileid, &stat);
if (error != 0)
return (error);
return (copyout(&stat, uap->stat, version));
stat = malloc(sizeof(*stat), M_TEMP, M_WAITOK | M_ZERO);
error = kern_kldstat(td, uap->fileid, stat);
if (error == 0)
error = copyout(stat, uap->stat, version);
free(stat, M_TEMP);
return (error);
}
int