This bug is awaiting verification that the kernel in -proposed solves
the problem. Please test the kernel and update this bug with the
results. If the problem is solved, change the tag 'verification-needed-
artful' to 'verification-done-artful'. If the problem still exists,
change the tag 'verification-needed-artful' to 'verification-failed-
artful'.

If verification is not done by 5 working days from today, this fix will
be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how
to enable and use -proposed. Thank you!


** Tags added: verification-needed-artful

-- 
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1775856

Title:
  register on binfmt_misc may overflow and crash the system

Status in linux package in Ubuntu:
  Incomplete
Status in linux source package in Precise:
  Incomplete
Status in linux source package in Trusty:
  Fix Committed
Status in linux source package in Xenial:
  Fix Committed
Status in linux source package in Artful:
  Fix Committed
Status in linux source package in Bionic:
  Fix Committed
Status in linux source package in Cosmic:
  Incomplete

Bug description:
  [Impact]
  When registering a new binfmt_misc handler, it is possible to overflow
  the offset to get a negative value, which might crash the system, or
  possibly leak kernel data.

  Here is a crash log when 2500000000 was used as an offset:

    BUG: unable to handle kernel paging request at ffff989cfd6edca0
    IP: load_misc_binary+0x22b/0x470 [binfmt_misc]
    PGD 1ef3e067 P4D 1ef3e067 PUD 0
    Oops: 0000 [#1] SMP NOPTI
    Modules linked in: binfmt_misc kvm_intel ppdev kvm irqbypass joydev 
input_leds serio_raw mac_hid parport_pc qemu_fw_cfg parpy
    CPU: 0 PID: 2499 Comm: bash Not tainted 4.15.0-22-generic #24-Ubuntu
    Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.1-1 
04/01/2014
    RIP: 0010:load_misc_binary+0x22b/0x470 [binfmt_misc]
    Call Trace:
      search_binary_handler+0x97/0x1d0
      do_execveat_common.isra.34+0x667/0x810
      SyS_execve+0x31/0x40
      do_syscall_64+0x73/0x130
      entry_SYSCALL_64_after_hwframe+0x3d/0xa2

  Use kstrtoint instead of simple_strtoul.  It will work as the code
  already set the delimiter byte to '\0' and we only do it when the field
  is not empty.

  [Test Case]
  Tested with offsets -1, 2500000000, UINT_MAX and INT_MAX.  Also tested
  with examples documented at Documentation/admin-guide/binfmt-misc.rst
  and other registrations from packages on Ubuntu.

  [Regression]
  Fail to register valid types. This was tested with a bionic kernel with the 
patch.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1775856/+subscriptions

-- 
Mailing list: https://launchpad.net/~kernel-packages
Post to     : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help   : https://help.launchpad.net/ListHelp

Reply via email to