[SCSI] mpt2sas: prevent heap overflows and unchecked reads
This commit is contained in:
parent
29f13318a3
commit
af9cec82a3
10
kernel.spec
10
kernel.spec
|
@ -855,6 +855,8 @@ Patch13956: bluetooth-bnep-fix-buffer-overflow.patch
|
||||||
Patch13957: agp-fix-arbitrary-kernel-memory-writes.patch
|
Patch13957: agp-fix-arbitrary-kernel-memory-writes.patch
|
||||||
# cve-2011-1746
|
# cve-2011-1746
|
||||||
Patch13958: agp-fix-oom-and-buffer-overflow.patch
|
Patch13958: agp-fix-oom-and-buffer-overflow.patch
|
||||||
|
# CVE-2011-1494, CVE-2011-1495
|
||||||
|
Patch13960: scsi-mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
|
||||||
|
|
||||||
%endif
|
%endif
|
||||||
|
|
||||||
|
@ -1620,6 +1622,8 @@ ApplyPatch bluetooth-bnep-fix-buffer-overflow.patch
|
||||||
ApplyPatch agp-fix-arbitrary-kernel-memory-writes.patch
|
ApplyPatch agp-fix-arbitrary-kernel-memory-writes.patch
|
||||||
# cve-2011-1746
|
# cve-2011-1746
|
||||||
ApplyPatch agp-fix-oom-and-buffer-overflow.patch
|
ApplyPatch agp-fix-oom-and-buffer-overflow.patch
|
||||||
|
# CVE-2011-1494, CVE-2011-1495
|
||||||
|
ApplyPatch scsi-mpt2sas-prevent-heap-overflows-and-unchecked-reads.patch
|
||||||
|
|
||||||
# END OF PATCH APPLICATIONS
|
# END OF PATCH APPLICATIONS
|
||||||
|
|
||||||
|
@ -2241,7 +2245,11 @@ fi
|
||||||
%kernel_variant_files %{with_pae_debug} PAEdebug
|
%kernel_variant_files %{with_pae_debug} PAEdebug
|
||||||
|
|
||||||
%changelog
|
%changelog
|
||||||
* Fri Apr 29 2011 Chuck Ebbert <cebbert@redhat.com> 2.6.34.9-69
|
* Mon May 02 2011 Chuck Ebbert <cebbert@redhat.com> 2.6.34.9-69
|
||||||
|
- [SCSI] mpt2sas: prevent heap overflows and unchecked reads
|
||||||
|
(CVE-2011-1494, CVE-2011-1495)
|
||||||
|
|
||||||
|
* Fri Apr 29 2011 Chuck Ebbert <cebbert@redhat.com>
|
||||||
- Bluetooth: bnep: fix buffer overflow (CVE-2011-1079)
|
- Bluetooth: bnep: fix buffer overflow (CVE-2011-1079)
|
||||||
- agp: fix arbitrary kernel memory writes (CVE-2011-1745)
|
- agp: fix arbitrary kernel memory writes (CVE-2011-1745)
|
||||||
- agp: fix OOM and buffer overflow (CVE-2011-1746)
|
- agp: fix OOM and buffer overflow (CVE-2011-1746)
|
||||||
|
|
|
@ -0,0 +1,85 @@
|
||||||
|
From: Dan Rosenberg <drosenberg@vsecurity.com>
|
||||||
|
Date: Tue, 5 Apr 2011 16:45:59 +0000 (-0400)
|
||||||
|
Subject: [SCSI] mpt2sas: prevent heap overflows and unchecked reads
|
||||||
|
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a1f74ae82d133ebb2aabb19d181944b4e83e9960
|
||||||
|
|
||||||
|
[trivial backport to 2.6.34]
|
||||||
|
|
||||||
|
[SCSI] mpt2sas: prevent heap overflows and unchecked reads
|
||||||
|
|
||||||
|
At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
|
||||||
|
length values are used to copy data from userspace into heap buffers
|
||||||
|
without bounds checking, allowing controllable heap corruption and
|
||||||
|
subsequently privilege escalation.
|
||||||
|
|
||||||
|
Additionally, user-supplied values are used to determine the size of a
|
||||||
|
copy_to_user() as well as the offset into the buffer to be read, with no
|
||||||
|
bounds checking, allowing users to read arbitrary kernel memory.
|
||||||
|
|
||||||
|
Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
|
||||||
|
Cc: stable@kernel.org
|
||||||
|
Acked-by: Eric Moore <eric.moore@lsi.com>
|
||||||
|
Signed-off-by: James Bottomley <James.Bottomley@suse.de>
|
||||||
|
---
|
||||||
|
|
||||||
|
diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
|
||||||
|
index 1c6d2b4..d72f1f2 100644
|
||||||
|
--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
|
||||||
|
+++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
|
||||||
|
@@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
|
||||||
|
data_out_sz = karg.data_out_size;
|
||||||
|
data_in_sz = karg.data_in_size;
|
||||||
|
|
||||||
|
+ /* Check for overflow and wraparound */
|
||||||
|
+ if (karg.data_sge_offset * 4 > ioc->request_sz ||
|
||||||
|
+ karg.data_sge_offset > (UINT_MAX / 4)) {
|
||||||
|
+ ret = -EINVAL;
|
||||||
|
+ goto out;
|
||||||
|
+ }
|
||||||
|
+
|
||||||
|
/* copy in request message frame from user */
|
||||||
|
if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
|
||||||
|
printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
|
||||||
|
@@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
|
||||||
|
Mpi2DiagBufferPostReply_t *mpi_reply;
|
||||||
|
int rc, i;
|
||||||
|
u8 buffer_type;
|
||||||
|
- unsigned long timeleft;
|
||||||
|
+ unsigned long timeleft, request_size, copy_size;
|
||||||
|
u16 smid;
|
||||||
|
u16 ioc_status;
|
||||||
|
u8 issue_reset = 0;
|
||||||
|
@@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
|
||||||
|
return -ENOMEM;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ request_size = ioc->diag_buffer_sz[buffer_type];
|
||||||
|
+
|
||||||
|
if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
|
||||||
|
printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
|
||||||
|
"or bytes_to_read are not 4 byte aligned\n", ioc->name,
|
||||||
|
@@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
|
||||||
|
return -EINVAL;
|
||||||
|
}
|
||||||
|
|
||||||
|
+ if (karg.starting_offset > request_size)
|
||||||
|
+ return -EINVAL;
|
||||||
|
+
|
||||||
|
diag_data = (void *)(request_data + karg.starting_offset);
|
||||||
|
dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
|
||||||
|
"offset(%d), sz(%d)\n", ioc->name, __func__,
|
||||||
|
diag_data, karg.starting_offset, karg.bytes_to_read));
|
||||||
|
|
||||||
|
+ /* Truncate data on requests that are too large */
|
||||||
|
+ if ((diag_data + karg.bytes_to_read < diag_data) ||
|
||||||
|
+ (diag_data + karg.bytes_to_read > request_data + request_size))
|
||||||
|
+ copy_size = request_size - karg.starting_offset;
|
||||||
|
+ else
|
||||||
|
+ copy_size = karg.bytes_to_read;
|
||||||
|
+
|
||||||
|
if (copy_to_user((void __user *)uarg->diagnostic_data,
|
||||||
|
- diag_data, karg.bytes_to_read)) {
|
||||||
|
+ diag_data, copy_size)) {
|
||||||
|
printk(MPT2SAS_ERR_FMT "%s: Unable to write "
|
||||||
|
"mpt_diag_read_buffer_t data @ %p\n", ioc->name,
|
||||||
|
__func__, diag_data);
|
Loading…
Reference in New Issue