Commit 4e08746d authored by Zijun Hu's avatar Zijun Hu Committed by Zhao Wenhui
Browse files

kobject_uevent: Fix OOB access within zap_modalias_env() 

stable inclusion
from stable-v5.10.224
commit 648d5490460d38436640da0812bf7f6351c150d2
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXP
CVE: CVE-2024-42292

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-5.10.y&id=648d5490460d38436640da0812bf7f6351c150d2



--------------------------------

commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc upstream.

zap_modalias_env() wrongly calculates size of memory block to move, so
will cause OOB memory access issue if variable MODALIAS is not the last
one within its @env parameter, fixed by correcting size to memmove.

Fixes: 9b3fa47d ("kobject: fix suppressing modalias in uevents delivered over netlink")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarZijun Hu <quic_zijuhu@quicinc.com>
Reviewed-by: default avatarLk Sii <lk_sii@163.com>
Link: https://lore.kernel.org/r/1717074877-11352-1-git-send-email-quic_zijuhu@quicinc.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhao Wenhui <zhaowenhui8@huawei.com>
parent a0db09dd

lib/kobject_uevent.c

+16 −1
Original line number Diff line number Diff line
@@ -432,8 +432,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) 
		len = strlen(env->envp[i]) + 1;



		if (i != env->envp_idx - 1) {

			/* @env->envp[] contains pointers to @env->buf[]

			 * with @env->buflen chars, and we are removing

			 * variable MODALIAS here pointed by @env->envp[i]

			 * with length @len as shown below:

			 *

			 * 0               @env->buf[]      @env->buflen

			 * ---------------------------------------------

			 * ^             ^              ^              ^

			 * |             |->   @len   <-| target block |

			 * @env->envp[0] @env->envp[i]  @env->envp[i + 1]

			 *

			 * so the "target block" indicated above is moved

			 * backward by @len, and its right size is

			 * @env->buflen - (@env->envp[i + 1] - @env->envp[0]).

			 */

			memmove(env->envp[i], env->envp[i + 1],

				env->buflen - len);

				env->buflen - (env->envp[i + 1] - env->envp[0]));



			for (j = i; j < env->envp_idx - 1; j++)

				env->envp[j] = env->envp[j + 1] - len;