fix: don't allow userspace copy to read kernel memory
authorMichael Jeanson <mjeanson@efficios.com>
Fri, 25 Sep 2020 20:05:00 +0000 (16:05 -0400)
committerMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Wed, 30 Sep 2020 16:06:05 +0000 (12:06 -0400)
commit6f9e33eac07801365005f3344fd560cb04a400f4
tree0e083613e3dbbdc1fa6ca06b1006b6695915b072
parenta1ffd991c43db2a7c031ca1c5c50681a6cebdd84
fix: don't allow userspace copy to read kernel memory

This patch fixes a security issue which allows the root user to read
arbitrary kernel memory. Considering the security model used in LTTng
userspace tooling for kernel tracing, this bug also allows members of
the 'tracing' group to read arbitrary kernel memory.

Calls to __copy_from_user_inatomic() where wrongly enclosed in
set_fs(KERNEL_DS) defeating the access_ok() calls and allowing to read
from kernel memory if a kernel address is provided.

Remove all set_fs() calls around __copy_from_user_inatomic().

As a side effect this will allow us to support v5.10 which should remove
set_fs().

Signed-off-by: Michael Jeanson <mjeanson@efficios.com>
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Change-Id: I35e4562c835217352c012ed96a7b8f93e941381e
lib/ringbuffer/backend.h
lttng-filter-interpreter.c
probes/lttng-probe-user.c
This page took 0.025408 seconds and 4 git commands to generate.