• Dan Rosenberg's avatar
    alpha: fix several security issues · 21c5977a
    Dan Rosenberg authored
    Fix several security issues in Alpha-specific syscalls.  Untested, but
    mostly trivial.
    
    1. Signedness issue in osf_getdomainname allows copying out-of-bounds
    kernel memory to userland.
    
    2. Signedness issue in osf_sysinfo allows copying large amounts of
    kernel memory to userland.
    
    3. Typo (?) in osf_getsysinfo bounds minimum instead of maximum copy
    size, allowing copying large amounts of kernel memory to userland.
    
    4. Usage of user pointer in osf_wait4 while under KERNEL_DS allows
    privilege escalation via writing return value of sys_wait4 to kernel
    memory.
    Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
    Cc: Richard Henderson <rth@twiddle.net>
    Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
    Cc: Matt Turner <mattst88@gmail.com>
    Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
    21c5977a
osf_sys.c 29.8 KB