To: linux-kernel@vger.kernel.org
Path: not-for-mail
From: daw@cs.berkeley.edu (David Wagner)
Newsgroups: isaac.lists.linux-kernel
Subject: Re: [PATCH] getsockopt() early argument sanity checking
Date: Mon, 21 Aug 2006 03:00:22 +0000 (UTC)
Organization: University of California, Berkeley
Message-ID: <ecb7k6$grh$1@taverner.cs.berkeley.edu>
References: <20060819230532.GA16442@openwall.com>
Reply-To: daw-usenet@taverner.cs.berkeley.edu (David Wagner)
NNTP-Posting-Host: taverner.cs.berkeley.edu
NNTP-Posting-Date: Mon, 21 Aug 2006 03:00:22 +0000 (UTC)
Originator: daw@taverner.cs.berkeley.edu (David Wagner)
Sender: linux-kernel-owner@vger.kernel.org
Content-Length: 1189
Lines: 18

Solar Designer  wrote:
>The patch makes getsockopt(2) sanity-check the value pointed to by
>the optlen argument early on.  This is a security hardening measure
>intended to prevent exploitation of certain potential vulnerabilities in
>socket type specific getsockopt() code on UP systems.

This looks broken to me.  It has a TOCTTOU (time-of-check-to-time-of-use)
vulnerability (i.e., race condition): you read the length value twice,
and assume that you will get the same value both times.  That assumption
is not valid.

It looks like it will be easy to bypass this check.  For instance,
think about what happens if an adversary stores the length field in a
mmaped region, for instance.  It should be easy for the value of that
length field to change between when it was first read and when it was
subsequently read.  I don't see how this provides any "hardening" if
the attacker knows how to read kernel source code.  Am I missing
something?
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/