fix: don't allow userspace copy to read kernel memory
authorMichael Jeanson <mjeanson@efficios.com>
Fri, 25 Sep 2020 20:05:00 +0000 (16:05 -0400)
committerMathieu Desnoyers <mathieu.desnoyers@efficios.com>
Wed, 30 Sep 2020 16:02:53 +0000 (12:02 -0400)
commit6f192a1604eccbbd6d2622edb51570b2862ac93f
treef3900680e2584c34ad05d96b55fcc46e99c7c71c
parenteb94dcd91d4ea827ebe0353249e309f1629a5032
fix: don't allow userspace copy to read kernel memory

This patch fixes a security issue which allows the root user to read
arbitrary kernel memory. Considering the security model used in LTTng
userspace tooling for kernel tracing, this bug also allows members of
the 'tracing' group to read arbitrary kernel memory.

Calls to __copy_from_user_inatomic() where wrongly enclosed in
set_fs(KERNEL_DS) defeating the access_ok() calls and allowing to read
from kernel memory if a kernel address is provided.

Remove all set_fs() calls around __copy_from_user_inatomic().

As a side effect this will allow us to support v5.10 which should remove
set_fs().

Signed-off-by: Michael Jeanson <mjeanson@efficios.com>
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Change-Id: I35e4562c835217352c012ed96a7b8f93e941381e
include/ringbuffer/backend.h
src/lttng-filter-interpreter.c
src/probes/lttng-probe-user.c
This page took 0.028172 seconds and 4 git commands to generate.