In tw_chrdev_ioctl(), the length of the data buffer is firstly copied from
the userspace pointer 'argp' and saved to the kernel object
'data_buffer_length'. Then a security check is performed on it to make sure
that the length is not more than 'TW_MAX_IOCTL_SECTORS * 512'. Otherwise,
an error code -EINVAL is returned. If the security check is passed, the
entire ioctl command is copied again from the 'argp' pointer and saved to
the kernel object 'tw_ioctl'. Then, various operations are performed on
'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer resides in
userspace, a malicious userspace process can race to change the buffer
length between the two copies. This way, the user can bypass the security
check and inject invalid data buffer length. This can cause potential
security issues in the following execution.
This patch checks for capable(CAP_SYS_ADMIN) in tw_chrdev_open() to avoid
the above issues.
Signed-off-by: Wenwen Wang <[email protected]>
---
drivers/scsi/3w-xxxx.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
index 33261b6..f6179e3 100644
--- a/drivers/scsi/3w-xxxx.c
+++ b/drivers/scsi/3w-xxxx.c
@@ -1033,6 +1033,9 @@ static int tw_chrdev_open(struct inode *inode, struct file *file)
dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n");
+ if (!capable(CAP_SYS_ADMIN))
+ return -EACCES;
+
minor_number = iminor(inode);
if (minor_number >= tw_device_extension_count)
return -ENODEV;
--
2.7.4
On Mon, May 7, 2018 at 5:54 PM, Wenwen Wang <[email protected]> wrote:
> In tw_chrdev_ioctl(), the length of the data buffer is firstly copied from
> the userspace pointer 'argp' and saved to the kernel object
> 'data_buffer_length'. Then a security check is performed on it to make sure
> that the length is not more than 'TW_MAX_IOCTL_SECTORS * 512'. Otherwise,
> an error code -EINVAL is returned. If the security check is passed, the
> entire ioctl command is copied again from the 'argp' pointer and saved to
> the kernel object 'tw_ioctl'. Then, various operations are performed on
> 'tw_ioctl' according to the 'cmd'. Given that the 'argp' pointer resides in
> userspace, a malicious userspace process can race to change the buffer
> length between the two copies. This way, the user can bypass the security
> check and inject invalid data buffer length. This can cause potential
> security issues in the following execution.
>
> This patch checks for capable(CAP_SYS_ADMIN) in tw_chrdev_open() to avoid
> the above issues.
>
> Signed-off-by: Wenwen Wang <[email protected]>
> ---
> drivers/scsi/3w-xxxx.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/scsi/3w-xxxx.c b/drivers/scsi/3w-xxxx.c
> index 33261b6..f6179e3 100644
> --- a/drivers/scsi/3w-xxxx.c
> +++ b/drivers/scsi/3w-xxxx.c
> @@ -1033,6 +1033,9 @@ static int tw_chrdev_open(struct inode *inode, struct file *file)
>
> dprintk(KERN_WARNING "3w-xxxx: tw_ioctl_open()\n");
>
> + if (!capable(CAP_SYS_ADMIN))
> + return -EACCES;
> +
> minor_number = iminor(inode);
> if (minor_number >= tw_device_extension_count)
> return -ENODEV;
> --
> 2.7.4
>
Acked-by: Adam Radford <[email protected]>