Re: [CHECKER] Probable security holes in 2.6.5

[Chris Wright <chrisw@osdl.org>]

> [BUG]
> /home/kash/linux/linux-2.6.5/kernel/module.c:1303:load_module:
> ERROR:TAINT: 1283:1303:Using user value "((*hdr).e_shstrndx * 0)"
> without first performing bounds checks
> [SOURCE_MODEL=(lib,copy_from_user,user,taintscalar)] [PATH=]    
> 
> 	/* Suck in entire file: we'll want most of it. */
> 	/* vmalloc barfs on "unusual" numbers.  Check here */
> 	if (len > 64 * 1024 * 1024 || (hdr = vmalloc(len)) == NULL)
> 		return ERR_PTR(-ENOMEM);
> Start --->
> 	if (copy_from_user(hdr, umod, len) != 0) {
> 
> 	... DELETED 14 lines ...
> 
> 	if (len < hdr->e_shoff + hdr->e_shnum * sizeof(Elf_Shdr))
> 		goto truncated;
> 
> 	/* Convenience variables */
> 	sechdrs = (void *)hdr + hdr->e_shoff;
> Error --->
> 	secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
> 	sechdrs[0].sh_addr = 0;
> 
> 	/* And these should exist, but gcc whinges if we don't init them */

Loading modules is inherently risky.  I'm not sure how much we want to
worry about malicious elf headers when loading a module...you've already
given away the family jewels ;-)

thanks,
-chris
-- 
Linux Security Modules     http://lsm.immunix.org     http://lsm.bkbits.net