d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Correct ELF header parsing code to prevent invalid ELF sections from

Browse Source 
disclosing memory.

Submitted by:	markj
Reported by:	Thomas Barabosch, Fraunhofer FKIE
Approved by:	re (implicit)
Approved by:	so
Security:	FreeBSD-SA-18:12.elf
Security:	CVE-2018-6924
Sponsored by:	The FreeBSD Foundation
This commit is contained in:
Gordon Tetlow 2018-09-12 04:57:34 +00:00
parent e382dd47aa
commit c9e562b188
2 changed files with 9 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
sys/kern/imgact_elf.c
View File

@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp)
break;
case PT_INTERP:
/* Path to interpreter */
if (phdr[i].p_filesz > MAXPATHLEN) {
if (phdr[i].p_filesz < 2 ||
phdr[i].p_filesz > MAXPATHLEN) {
uprintf("Invalid PT_INTERP\n");
error = ENOEXEC;
goto ret;
@ -870,6 +871,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp)
} else {
interp = __DECONST(char *, imgp->image_header) +
phdr[i].p_offset;
if (interp[interp_name_len - 1] != '\0') {
uprintf("Invalid PT_INTERP\n");
error = ENOEXEC;
goto ret;
}
}
break;
case PT_GNU_STACK:

2
sys/kern/vfs_vnops.c
View File

@ -527,6 +527,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, int len, off_t offset,
struct vn_io_fault_args args;
int error, lock_flags;
if (offset < 0 && vp->v_type != VCHR)
return (EINVAL);
auio.uio_iov = &aiov;
auio.uio_iovcnt = 1;
aiov.iov_base = base;