Commit 5b3a8d85 authored by Zijun Hu's avatar Zijun Hu Committed by Zhao Wenhui
Browse files

kobject_uevent: Fix OOB access within zap_modalias_env() 

mainline inclusion
from mainline-v6.11-rc1
commit dd6e9894b451e7c85cceb8e9dc5432679a70e7dc
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAKPXP
CVE: CVE-2024-42292

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=dd6e9894b451e7c85cceb8e9dc5432679a70e7dc



--------------------------------

zap_modalias_env() wrongly calculates size of memory block to move, so
will cause OOB memory access issue if variable MODALIAS is not the last
one within its @env parameter, fixed by correcting size to memmove.

Fixes: 9b3fa47d ("kobject: fix suppressing modalias in uevents delivered over netlink")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarZijun Hu <quic_zijuhu@quicinc.com>
Reviewed-by: default avatarLk Sii <lk_sii@163.com>
Link: https://lore.kernel.org/r/1717074877-11352-1-git-send-email-quic_zijuhu@quicinc.com


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarZhao Wenhui <zhaowenhui8@huawei.com>
parent 73a86ad6

lib/kobject_uevent.c

+16 −1
Original line number Original line Diff line number Diff line
@@ -430,8 +430,23 @@ static void zap_modalias_env(struct kobj_uevent_env *env) 
		len = strlen(env->envp[i]) + 1;

		len = strlen(env->envp[i]) + 1;





		if (i != env->envp_idx - 1) {

		if (i != env->envp_idx - 1) {

			/* @env->envp[] contains pointers to @env->buf[]

			 * with @env->buflen chars, and we are removing

			 * variable MODALIAS here pointed by @env->envp[i]

			 * with length @len as shown below:

			 *

			 * 0               @env->buf[]      @env->buflen

			 * ---------------------------------------------

			 * ^             ^              ^              ^

			 * |             |->   @len   <-| target block |

			 * @env->envp[0] @env->envp[i]  @env->envp[i + 1]

			 *

			 * so the "target block" indicated above is moved

			 * backward by @len, and its right size is

			 * @env->buflen - (@env->envp[i + 1] - @env->envp[0]).

			 */

			memmove(env->envp[i], env->envp[i + 1],

			memmove(env->envp[i], env->envp[i + 1],

				env->buflen - len);

				env->buflen - (env->envp[i + 1] - env->envp[0]));





			for (j = i; j < env->envp_idx - 1; j++)

			for (j = i; j < env->envp_idx - 1; j++)

				env->envp[j] = env->envp[j + 1] - len;

				env->envp[j] = env->envp[j + 1] - len;