• Mathias Krause's avatar
    proc: prevent accessing /proc/<PID>/environ until it's ready · 8148a73c
    Mathias Krause authored
    If /proc/<PID>/environ gets read before the envp[] array is fully set up
    in create_{aout,elf,elf_fdpic,flat}_tables(), we might end up trying to
    read more bytes than are actually written, as env_start will already be
    set but env_end will still be zero, making the range calculation
    underflow, allowing to read beyond the end of what has been written.
    
    Fix this as it is done for /proc/<PID>/cmdline by testing env_end for
    zero.  It is, apparently, intentionally set last in create_*_tables().
    
    This bug was found by the PaX size_overflow plugin that detected the
    arithmetic underflow of 'this_len = env_end - (env_start + src)' when
    env_end is still zero.
    
    The expected consequence is that userland trying to access
    /proc/<PID>/environ of a not yet fully set up process may get
    inconsistent data as we're in the middle of copying in the environment
    variables.
    
    Fixes: https://forums.grsecurity.net/viewtopic.php?f=3&t=4363
    Fixes: https://bugzilla.kernel.org/show_bug.cgi?id=116461Signed-off-by: default avatarMathias Krause <minipli@googlemail.com>
    Cc: Emese Revfy <re.emese@gmail.com>
    Cc: Pax Team <pageexec@freemail.hu>
    Cc: Al Viro <viro@zeniv.linux.org.uk>
    Cc: Mateusz Guzik <mguzik@redhat.com>
    Cc: Alexey Dobriyan <adobriyan@gmail.com>
    Cc: Cyrill Gorcunov <gorcunov@openvz.org>
    Cc: Jarod Wilson <jarod@redhat.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    8148a73c
base.c 81.1 KB