Both patches come from the same review of the module ELF validator, and
both fix an out-of-bounds read of a section field that the validator
leaves unchecked on purpose.
elf_validity_check_sectionheaders() exempts SHT_NULL and SHT_NOBITS
sections from its bounds checks, on the assumption that a section with
no contents has nothing to dereference. The loaders that run after it do
not share that assumption: they read sh_name and sh_offset for every
section, so an exempted section carries an unvalidated field into a
string lookup or a pointer computation. Commit 9a5ff4568932 ("module:
validate string table section types") closed two such gaps for
.shstrtab and .strtab; these two patches close the ones that remain.
Patch 1 gives the undefined sh_name of a SHT_NULL section a safe value,
so the section walkers that follow read the empty string instead of
running past .shstrtab.
Patch 2 requires the __version_ext_names section to be SHT_PROGBITS
before elf_validity_cache_index_versions() dereferences its sh_offset,
so a SHT_NOBITS section of that name - which the validator exempts and
which holds no file data - cannot drive the extended version name walk
outside the module image or make it read unrelated bytes as a name.
Each patch stands alone and can be applied or backported separately;
they are grouped only because they share a root cause. Both were
reproduced on 704340f1cd0d with KASAN, and each is fixed by its own
change.
Changes in v2. v1 was posted here:
https://lore.kernel.org/all/[email protected]/
- Patch 2: require __version_ext_names to be SHT_PROGBITS before its
sh_offset is dereferenced, instead of bounding the offset. Review
pointed out the offset bound is narrower than the bug: an in-bounds
SHT_NOBITS section passes it and the walk then reads unrelated file
bytes as a version name. The type check rejects both the
out-of-bounds and the in-bounds variants; the reproducer now covers
both. Details in the patch's tear-line notes.
- Patch 1: unchanged since v1.
Fang Xieyan (2):
module: Sanitize the undefined sh_name of SHT_NULL sections
module: Validate the __version_ext_names section type
kernel/module/main.c | 29 +++++++++++++++++++++++++++--
1 file changed, 27 insertions(+), 2 deletions(-)
--
2.50.1 (Apple Git-155)
