Repository navigation
scmp_bpf_sim: Don't overread struct seccomp_data - #501
Open
stevegrubb wants to merge 1 commit into
Open
stevegrubb wants to merge 1 commit into
stevegrubb wants to merge 1 commit into
Conversation
In the BPF_LD+BPF_W+BPF_ABS case of bpf_execute, a check is done of k to ensure it is < BPF_SYSCALL_MAX which is 64. The way it is written, passing a value of 63 is legal and passes the check. But it is going to read sizeof(unint32_t) or 4 bytes meaning a read from offset 63 to 66. This is beyond struct seccomp_data's end. Condition the check by subtracting sizeof(unint32_t) to allow the right size offset. Now if someone passes offset 60, it is equal to the limit and allows reading bytes 60 - 63 which fits within struct seccomp_data. scmp_bpf_sim doesn't appear to be shipped and I don't think anyone can use this flaw to any effect as it crosses no trust boundaries, there is no demonstrated write, code execution, privilege escalation, or useful information disclosure. Just undefined behavior. Signed-off-by: Steve Grubb <ausearch.1@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In the BPF_LD+BPF_W+BPF_ABS case of bpf_execute, a check is done of k to ensure it is < BPF_SYSCALL_MAX which is 64. The way it is written, passing a value of 63 is legal and passes the check. But it is going to read sizeof(unint32_t) or 4 bytes meaning a read from offset 63 to 66. This is beyond struct seccomp_data's end.
Condition the check by subtracting sizeof(unint32_t) to allow the right size offset. Now if someone passes offset 60, it is equal to the limit and allows reading bytes 60 - 63 which fits within struct seccomp_data.
scmp_bpf_sim doesn't appear to be shipped and I don't think anyone can use this flaw to any effect as it crosses no trust boundaries, there is no demonstrated write, code execution, privilege escalation, or useful information disclosure. Just undefined behavior.