Home| summaryrefslogtreecommitdiff |
| author | Jeff Mahoney <jeffm@suse.de> | 2010-09-16 18:58:28 (GMT) |
|---|---|---|
| committer | Jeff Mahoney <jeffm@suse.de> | 2010-09-16 18:58:32 (GMT) |
| commit | e6266b98cbc58a9ffe49fb4a652557fd5ddfae0d (patch) (side-by-side diff) | |
| tree | 292bcbffaa605a41de73d67147382562674df886 | |
| parent | 664a0ac1d4264279ad3ed00d1beac8688c31f3b9 (diff) | |
- x86-64, compat: Retruncate rax after ia32 syscall entry tracing
(CVE-2010-3301 bnc#639708).
| -rw-r--r-- | patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing | 53 | ||||
| -rw-r--r-- | series.conf | 1 |
2 files changed, 54 insertions, 0 deletions
diff --git a/patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing b/patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing new file mode 100644 index 0000000..6dd270f --- a/dev/null +++ b/patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing @@ -0,0 +1,53 @@ +From: Roland McGrath <roland@redhat.com> +Date: Tue, 14 Sep 2010 19:22:58 +0000 (-0700) +Subject: x86-64, compat: Retruncate rax after ia32 syscall entry tracing +Git-commit: eefdca043e8391dcd719711716492063030b55ac +References: CVE-2010-3301 bnc#639708 +Patch-mainline: 2.6.36 +Introduced-by: 2.6.27 + +x86-64, compat: Retruncate rax after ia32 syscall entry tracing + +In commit d4d6715, we reopened an old hole for a 64-bit ptracer touching a +32-bit tracee in system call entry. A %rax value set via ptrace at the +entry tracing stop gets used whole as a 32-bit syscall number, while we +only check the low 32 bits for validity. + +Fix it by truncating %rax back to 32 bits after syscall_trace_enter, +in addition to testing the full 64 bits as has already been added. + +Reported-by: Ben Hawkes <hawkes@sota.gen.nz> +Signed-off-by: Roland McGrath <roland@redhat.com> +Signed-off-by: H. Peter Anvin <hpa@linux.intel.com> +Acked-by: Jeff Mahoney <jeffm@suse.com> +--- + + arch/x86/ia32/ia32entry.S | 8 +++++++- + 1 file changed, 7 insertions(+), 1 deletion(-) + +diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S +index 84e3a4e..518bb99 100644 +--- a/arch/x86/ia32/ia32entry.S ++++ b/arch/x86/ia32/ia32entry.S +@@ -50,7 +50,12 @@ + /* + * Reload arg registers from stack in case ptrace changed them. + * We don't reload %eax because syscall_trace_enter() returned +- * the value it wants us to use in the table lookup. ++ * the %rax value we should see. Instead, we just truncate that ++ * value to 32 bits again as we did on entry from user mode. ++ * If it's a new value set by user_regset during entry tracing, ++ * this matches the normal truncation of the user-mode value. ++ * If it's -1 to make us punt the syscall, then (u32)-1 is still ++ * an appropriately invalid value. + */ + .macro LOAD_ARGS32 offset, _r9=0 + .if \_r9 +@@ -60,6 +65,7 @@ + movl \offset+48(%rsp),%edx + movl \offset+56(%rsp),%esi + movl \offset+64(%rsp),%edi ++ movl %eax,%eax /* zero extension */ + .endm + + .macro CFI_STARTPROC32 simple diff --git a/series.conf b/series.conf index 79f294e..9903568 100644 --- a/series.conf +++ b/series.conf @@ -137,2 +137,3 @@ patches.suse/x86-mark_rodata_rw.patch + patches.fixes/x86-64-compat-retruncate-rax-after-ia32-syscall-entry-tracing |