From 67466f266d4209744a2f6f3e8e92672110be1df3 Mon Sep 17 00:00:00 2001 From: Tobias Stoeckmann Date: Mon, 9 Feb 2015 23:22:51 +0100 Subject: [PATCH] Prevent offset + size overflow. it is possible to overflow uint64_t by summing variables offset and size up in elf_get_section_info. Thee values are extracted from module file and are possibly maliciously tampered with. If offset is in valid range and size very large, the result will overflow and the size check passes. Later on, this will most likely lead to a segmentation fault due to accessing uninitialized memory. Attached please find a proof of concept module, which will trigger a segmentation fault on modinfo. Tested on amd64: tobias:~$ modinfo poc.ko filename: /home/tobias/poc.ko Segmentation fault There are more errors of this type in the ELF handling code that will be fixed in other patches. --- libkmod/libkmod-elf.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/libkmod/libkmod-elf.c b/libkmod/libkmod-elf.c index d1b0f33a..8a8a73d9 100644 --- a/libkmod/libkmod-elf.c +++ b/libkmod/libkmod-elf.c @@ -251,7 +251,7 @@ static inline int elf_get_section_info(const struct kmod_elf *elf, uint16_t idx, #undef READV min_size = *offset + *size; - if (min_size > elf->size) { + if (ULLONG_MAX - *offset < *size || min_size > elf->size) { ELFDBG(elf, "out-of-bounds: %"PRIu64" >= %"PRIu64" (ELF size)\n", min_size, elf->size); return -EINVAL; -- 2.47.2