fix: don't allow userspace copy to read kernel memory
authorMichael Jeanson <mjeanson@efficios.com>
Fri, 25 Sep 2020 20:05:00 +0000 (16:05 -0400)
committerMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Wed, 30 Sep 2020 16:06:09 +0000 (12:06 -0400)
commit5facfb7b687ca6fcb8b5715a2ea85800bacff534
treef503f1af43e3e5a745992d60ff80b6ed5ac3c445
parent8c51c31506f61a9af071b1c1e852422fd13cca35
fix: don't allow userspace copy to read kernel memory

This patch fixes a security issue which allows the root user to read
arbitrary kernel memory. Considering the security model used in LTTng
userspace tooling for kernel tracing, this bug also allows members of
the 'tracing' group to read arbitrary kernel memory.

Calls to __copy_from_user_inatomic() where wrongly enclosed in
set_fs(KERNEL_DS) defeating the access_ok() calls and allowing to read
from kernel memory if a kernel address is provided.

Remove all set_fs() calls around __copy_from_user_inatomic().

As a side effect this will allow us to support v5.10 which should remove
set_fs().

Signed-off-by: Michael Jeanson <mjeanson@efficios.com>
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Change-Id: I35e4562c835217352c012ed96a7b8f93e941381e
lib/ringbuffer/backend.h
lttng-filter-interpreter.c
probes/lttng-probe-user.c
This page took 0.025782 seconds and 4 git commands to generate.