From 6034fb773e28ddc0540dfd809d82728b52543532 Mon Sep 17 00:00:00 2001 From: Chuck Ebbert Date: Mon, 2 May 2011 18:30:35 -0400 Subject: [PATCH] [SCSI] mpt2sas: prevent heap overflows and unchecked reads --- kernel.spec | 10 +++ ...t-heap-overflows-and-unchecked-reads.patch | 83 +++++++++++++++++++ 2 files changed, 93 insertions(+) create mode 100644 scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch diff --git a/kernel.spec b/kernel.spec index 4b1898aa0..b92634dd9 100644 --- a/kernel.spec +++ b/kernel.spec @@ -726,6 +726,9 @@ Patch12306: scsi-sd-downgrade-caching-printk-from-error-to-notice.patch #netconsole fixes Patch12400: linux-2.6-netconsole-deadlock.patch +# CVE-2011-1494, CVE-2011-1495 +Patch12401: scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch + %endif BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root @@ -1345,6 +1348,9 @@ ApplyPatch scsi-sd-downgrade-caching-printk-from-error-to-notice.patch #rhbz 668231 ApplyPatch linux-2.6-netconsole-deadlock.patch +# CVE-2011-1494, CVE-2011-1495 +ApplyPatch scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch + # END OF PATCH APPLICATIONS %endif @@ -1953,6 +1959,10 @@ fi # and build. %changelog +* Mon May 02 2011 Chuck Ebbert +- [SCSI] mpt2sas: prevent heap overflows and unchecked reads + (CVE-2011-1494, CVE-2011-1495) + * Mon May 02 2011 Kyle McMartin 2.6.38.5-22 - And to the released 2.6.38.5 diff --git a/scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch b/scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch new file mode 100644 index 000000000..1803cf84f --- /dev/null +++ b/scsi-mptsas-prevent-heap-overflows-and-unchecked-reads.patch @@ -0,0 +1,83 @@ +From: Dan Rosenberg +Date: Tue, 5 Apr 2011 16:45:59 +0000 (-0400) +Subject: [SCSI] mpt2sas: prevent heap overflows and unchecked reads +X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=a1f74ae82d133ebb2aabb19d181944b4e83e9960 + +[SCSI] mpt2sas: prevent heap overflows and unchecked reads + +At two points in handling device ioctls via /dev/mpt2ctl, user-supplied +length values are used to copy data from userspace into heap buffers +without bounds checking, allowing controllable heap corruption and +subsequently privilege escalation. + +Additionally, user-supplied values are used to determine the size of a +copy_to_user() as well as the offset into the buffer to be read, with no +bounds checking, allowing users to read arbitrary kernel memory. + +Signed-off-by: Dan Rosenberg +Cc: stable@kernel.org +Acked-by: Eric Moore +Signed-off-by: James Bottomley +--- + +diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c +index 1c6d2b4..d72f1f2 100644 +--- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c ++++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c +@@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc, + goto out; + } + ++ /* Check for overflow and wraparound */ ++ if (karg.data_sge_offset * 4 > ioc->request_sz || ++ karg.data_sge_offset > (UINT_MAX / 4)) { ++ ret = -EINVAL; ++ goto out; ++ } ++ + /* copy in request message frame from user */ + if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) { + printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__, +@@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state) + Mpi2DiagBufferPostReply_t *mpi_reply; + int rc, i; + u8 buffer_type; +- unsigned long timeleft; ++ unsigned long timeleft, request_size, copy_size; + u16 smid; + u16 ioc_status; + u8 issue_reset = 0; +@@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state) + return -ENOMEM; + } + ++ request_size = ioc->diag_buffer_sz[buffer_type]; ++ + if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) { + printk(MPT2SAS_ERR_FMT "%s: either the starting_offset " + "or bytes_to_read are not 4 byte aligned\n", ioc->name, +@@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state) + return -EINVAL; + } + ++ if (karg.starting_offset > request_size) ++ return -EINVAL; ++ + diag_data = (void *)(request_data + karg.starting_offset); + dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), " + "offset(%d), sz(%d)\n", ioc->name, __func__, + diag_data, karg.starting_offset, karg.bytes_to_read)); + ++ /* Truncate data on requests that are too large */ ++ if ((diag_data + karg.bytes_to_read < diag_data) || ++ (diag_data + karg.bytes_to_read > request_data + request_size)) ++ copy_size = request_size - karg.starting_offset; ++ else ++ copy_size = karg.bytes_to_read; ++ + if (copy_to_user((void __user *)uarg->diagnostic_data, +- diag_data, karg.bytes_to_read)) { ++ diag_data, copy_size)) { + printk(MPT2SAS_ERR_FMT "%s: Unable to write " + "mpt_diag_read_buffer_t data @ %p\n", ioc->name, + __func__, diag_data);