[CVE-2011-1494][Maverick][PATCH] mpt2sas: prevent heap overflows and unchecked reads, CVE-2011-1494

Stefan Bader stefan.bader at canonical.com
Tue May 24 07:28:33 UTC 2011


On 23.05.2011 22:57, Herton Ronaldo Krzesinski wrote:
> From: Dan Rosenberg<drosenberg at vsecurity.com>
>
> CVE-2011-1494
>
> BugLink: http://bugs.launchpad.net/bugs/787145
>
> Released until now with stable versions 2.6.32.40, 2.6.33.13, 2.6.38.6
>
> At two points in handling device ioctls via /dev/mpt2ctl, user-supplied
> length values are used to copy data from userspace into heap buffers
> without bounds checking, allowing controllable heap corruption and
> subsequently privilege escalation.
>
> Additionally, user-supplied values are used to determine the size of a
> copy_to_user() as well as the offset into the buffer to be read, with no
> bounds checking, allowing users to read arbitrary kernel memory.
>
> Signed-off-by: Dan Rosenberg<drosenberg at vsecurity.com>
> Cc: stable at kernel.org
> Acked-by: Eric Moore<eric.moore at lsi.com>
> Signed-off-by: James Bottomley<James.Bottomley at suse.de>
> (backported from commit a1f74ae82d133ebb2aabb19d181944b4e83e9960 upstream)
> Signed-off-by: Herton Krzesinski<herton.krzesinski at canonical.com>
> ---
>   drivers/scsi/mpt2sas/mpt2sas_ctl.c |   23 +++++++++++++++++++++--
>   1 files changed, 21 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
> index d88e975..9e689c8 100644
> --- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
> +++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
> @@ -637,6 +637,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
>   	data_out_sz = karg.data_out_size;
>   	data_in_sz = karg.data_in_size;
>
> +	/* Check for overflow and wraparound */
> +	if (karg.data_sge_offset * 4>  ioc->request_sz ||
> +	    karg.data_sge_offset>  (UINT_MAX / 4)) {
> +		ret = -EINVAL;
> +		goto out;
> +	}
> +
>   	/* copy in request message frame from user */
>   	if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
>   		printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
> @@ -1883,7 +1890,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
>   	Mpi2DiagBufferPostReply_t *mpi_reply;
>   	int rc, i;
>   	u8 buffer_type;
> -	unsigned long timeleft;
> +	unsigned long timeleft, request_size, copy_size;
>   	u16 smid;
>   	u16 ioc_status;
>   	u8 issue_reset = 0;
> @@ -1919,6 +1926,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
>   		return -ENOMEM;
>   	}
>
> +	request_size = ioc->diag_buffer_sz[buffer_type];
> +
>   	if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
>   		printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
>   		    "or bytes_to_read are not 4 byte aligned\n", ioc->name,
> @@ -1926,13 +1935,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
>   		return -EINVAL;
>   	}
>
> +	if (karg.starting_offset>  request_size)
> +		return -EINVAL;
> +
>   	diag_data = (void *)(request_data + karg.starting_offset);
>   	dctlprintk(ioc, printk(MPT2SAS_DEBUG_FMT "%s: diag_buffer(%p), "
>   	    "offset(%d), sz(%d)\n", ioc->name, __func__,
>   	    diag_data, karg.starting_offset, karg.bytes_to_read));
>
> +	/* Truncate data on requests that are too large */
> +	if ((diag_data + karg.bytes_to_read<  diag_data) ||
> +	    (diag_data + karg.bytes_to_read>  request_data + request_size))
> +		copy_size = request_size - karg.starting_offset;
> +	else
> +		copy_size = karg.bytes_to_read;
> +
>   	if (copy_to_user((void __user *)uarg->diagnostic_data,
> -	    diag_data, karg.bytes_to_read)) {
> +	    diag_data, copy_size)) {
>   		printk(MPT2SAS_ERR_FMT "%s: Unable to write "
>   		    "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
>   		    __func__, diag_data);
Acked-by: Stefan Bader <stefan.bader at canonical.com>




More information about the kernel-team mailing list