Re: [PATCH] thinkpad-acpi: Avoid heap buffer overrun

[Henrique de Moraes Holschuh]

On Tue, 21 Jul 2009, Michael Buesch wrote:
> Avoid a heap buffer overrun triggered by an integer overflow of the userspace
> controlled "count" variable.
> If userspace passes in a "count" of (size_t)-1l, the kmalloc size will overflow
> to ((size_t)-1l + 2) = 1, so only one byte will be allocated. However, copy_from_user()
> will attempt to copy 0xFFFFFFFF (or 0xFFFFFFFFFFFFFFFF on 64bit) bytes to the buffer.

Good catch.  Thank you!

Patch acked, and queued.  I am sending it to Len Brown now (although I think
he is taking his post-rc2 time off, so it might take a week or so for it to
be sent to Linus).

It is a security hole alright, and while it is NOT open in a default
configuration, it CAN be used for local priviledge escalation on any system
where the distro or the local administratior used chown() or chmod() to
unrestrict access to /proc/acpi/ibm/*.

The code in question is in mainline since 2.6.12, and maybe even earlier.
Argh.

-- 
  "One disk to rule them all, One disk to find them. One disk to bring
  them all and in the darkness grind them. In the Land of Redmond
  where the shadows lie." -- The Silicon Valley Tarot
  Henrique Holschuh
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/