From c9e562b188682eb9be39a8124893aa172b57d3ca Mon Sep 17 00:00:00 2001 From: Gordon Tetlow Date: Wed, 12 Sep 2018 04:57:34 +0000 Subject: [PATCH] Correct ELF header parsing code to prevent invalid ELF sections from disclosing memory. Submitted by: markj Reported by: Thomas Barabosch, Fraunhofer FKIE Approved by: re (implicit) Approved by: so Security: FreeBSD-SA-18:12.elf Security: CVE-2018-6924 Sponsored by: The FreeBSD Foundation --- sys/kern/imgact_elf.c | 8 +++++++- sys/kern/vfs_vnops.c | 2 ++ 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/sys/kern/imgact_elf.c b/sys/kern/imgact_elf.c index 2a73a722148..f4302d46665 100644 --- a/sys/kern/imgact_elf.c +++ b/sys/kern/imgact_elf.c @@ -839,7 +839,8 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp) break; case PT_INTERP: /* Path to interpreter */ - if (phdr[i].p_filesz > MAXPATHLEN) { + if (phdr[i].p_filesz < 2 || + phdr[i].p_filesz > MAXPATHLEN) { uprintf("Invalid PT_INTERP\n"); error = ENOEXEC; goto ret; @@ -870,6 +871,11 @@ __CONCAT(exec_, __elfN(imgact))(struct image_params *imgp) } else { interp = __DECONST(char *, imgp->image_header) + phdr[i].p_offset; + if (interp[interp_name_len - 1] != '\0') { + uprintf("Invalid PT_INTERP\n"); + error = ENOEXEC; + goto ret; + } } break; case PT_GNU_STACK: diff --git a/sys/kern/vfs_vnops.c b/sys/kern/vfs_vnops.c index 09f665e8f3f..00392ee3a07 100644 --- a/sys/kern/vfs_vnops.c +++ b/sys/kern/vfs_vnops.c @@ -527,6 +527,8 @@ vn_rdwr(enum uio_rw rw, struct vnode *vp, void *base, int len, off_t offset, struct vn_io_fault_args args; int error, lock_flags; + if (offset < 0 && vp->v_type != VCHR) + return (EINVAL); auio.uio_iov = &aiov; auio.uio_iovcnt = 1; aiov.iov_base = base; -- 2.45.0