Buffer overflow in UM leading to potential crash with kernels up to 4.4.y

This is a multi-part message in MIME format.
--------------84B22FF9E005A6ABDDF1B359
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit

Hello everyone,

the RSBAC user management (UM) code in kernels up to 4.4.y contains a
buffer overflow in the password checking code. When the password to be
checked has at least 20 characters, one extra 0 is written beyond the
end of the allocated buffer. The bug has been fixed on the fly while
porting RSBAC to the new hashing interface in kernel 4.9, but not for
older kernels.

The overflow can lead to spurious system crashes due to memory
management corruption. In my opinion it cannot be exploited to execute
any code. As a workaround, slub debugging detects and corrects the
corruption. Just add slub_debug to your kernel parameters, if you happen
to use the slub implementation of memory slabs, which should be default
in all recent kernels.

The bug has been fixed today for all supported kernels in the latest git
commits. Additionally, I have attached a patch for the 4.4 kernel series.

Amon.
-- 
http://www.rsbac.org - GnuPG: 2048g/5DEAAA30 2002-10-22

--------------84B22FF9E005A6ABDDF1B359
Content-Type: text/x-patch;
 name="um-buffer-fix.diff"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: attachment;
 filename="um-buffer-fix.diff"

commit 95a02ed360c175ef64a18fa0f452a3b799e6dfcf
Author: Amon Ott <[email protected]>
Date:   Tue Sep 5 11:10:29 2017 +0200

    rsbac_um_hash(): copy password with memcpy(), not strcpy().
    strcpy() adds a trailing 0 byte and then overflows our buffer,
    if the password is longer than 20 characters.

diff --git a/rsbac/data_structures/um_data_structures.c b/rsbac/data_stru=
ctures/um_data_structures.c
index 0033a62..46a2e90 100644
--- a/rsbac/data_structures/um_data_structures.c
+++ b/rsbac/data_structures/um_data_structures.c
@@ -1,9 +1,9 @@
 /*************************************************** */
 /* Rule Set Based Access Control                     */
 /* Implementation of User Management data structures */
-/* Author and (c) 1999-2016: Amon Ott <[email protected]> */
+/* Author and (c) 1999-2017: Amon Ott <[email protected]> */
 /*                                                   */
-/* Last modified: 07/Jan/2016                        */
+/* Last modified: 05/Sep/2017                        */
 /*************************************************** */
=20
 #include <linux/types.h>
@@ -704,7 +704,7 @@ int rsbac_um_hash(char *pass, __u32 salt)
=20
 	plen =3D strlen(pass);
 	len =3D rsbac_max(plen + sizeof(salt), RSBAC_UM_PASS_LEN);
-	buffer =3D rsbac_kmalloc_unlocked(len);
+	buffer =3D rsbac_kmalloc_clear_unlocked(len);
 	if (!buffer)
 		return -RSBAC_ENOMEM;
=20
@@ -721,9 +721,8 @@ int rsbac_um_hash(char *pass, __u32 salt)
 		err =3D -RSBAC_ENOTFOUND;
 		goto out;
 	}
-	memset(buffer, 0, len);
 	memcpy(buffer, &salt, sizeof(salt));
-	strcpy(buffer + sizeof(salt), pass);
+	memcpy(buffer + sizeof(salt), pass, plen);
 	sg_init_one(sg, buffer, plen + sizeof(salt));
=20
 	hd.tfm =3D tfm;

--------------84B22FF9E005A6ABDDF1B359
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

_______________________________________________
rsbac mailing list
[email protected]
http://www.rsbac.org/mailman/listinfo/rsbac
--------------84B22FF9E005A6ABDDF1B359--