iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
efe3de79e0
linux/security/selinux/ss
History
Sachin Grover efe3de79e0 selinux: KASAN: slab-out-of-bounds in xattr_getsecurity 
Call trace:
 [<ffffff9203a8d7a8>] dump_backtrace+0x0/0x428
 [<ffffff9203a8dbf8>] show_stack+0x28/0x38
 [<ffffff920409bfb8>] dump_stack+0xd4/0x124
 [<ffffff9203d187e8>] print_address_description+0x68/0x258
 [<ffffff9203d18c00>] kasan_report.part.2+0x228/0x2f0
 [<ffffff9203d1927c>] kasan_report+0x5c/0x70
 [<ffffff9203d1776c>] check_memory_region+0x12c/0x1c0
 [<ffffff9203d17cdc>] memcpy+0x34/0x68
 [<ffffff9203d75348>] xattr_getsecurity+0xe0/0x160
 [<ffffff9203d75490>] vfs_getxattr+0xc8/0x120
 [<ffffff9203d75d68>] getxattr+0x100/0x2c8
 [<ffffff9203d76fb4>] SyS_fgetxattr+0x64/0xa0
 [<ffffff9203a83f70>] el0_svc_naked+0x24/0x28

If user get root access and calls security.selinux setxattr() with an
embedded NUL on a file and then if some process performs a getxattr()
on that file with a length greater than the actual length of the string,
it would result in a panic.

To fix this, add the actual length of the string to the security context
instead of the length passed by the userspace process.

Signed-off-by: Sachin Grover <sgrover@codeaurora.org>
Cc: stable@vger.kernel.org
Signed-off-by: Paul Moore <paul@paul-moore.com>
2018-05-29 20:11:19 -04:00
..
avtab.c selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
avtab.h selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
conditional.c selinux: remove redundant assignment to len 2017-10-16 18:37:23 -04:00
conditional.h selinux: extended permissions for ioctls 2015-07-13 13:31:58 -04:00
constraint.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
context.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
ebitmap.c selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
ebitmap.h selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
hashtab.c selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
hashtab.h selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
mls_types.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
mls.c selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
mls.h selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
policydb.c selinux: update my email address 2017-08-17 15:32:55 -04:00
policydb.h selinux: update my email address 2017-08-17 15:32:55 -04:00
services.c selinux: KASAN: slab-out-of-bounds in xattr_getsecurity 2018-05-29 20:11:19 -04:00
services.h selinux: wrap global selinux state 2018-03-01 18:48:02 -05:00
sidtab.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
sidtab.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
status.c selinux: rename the {is,set}_enforcing() functions 2018-03-02 14:18:55 -05:00
symtab.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
symtab.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00