e8905ec27e
Currently the following offset and environment address range check in
environ_read() of /proc/<pid>/environ is buggy:
int this_len = mm->env_end - (mm->env_start + src);
if (this_len <= 0)
break;
Large or negative offsets on /proc/<pid>/environ converted to 'unsigned
long' may pass this check since '(mm->env_start + src)' can overflow and
'this_len' will be positive.
This can turn /proc/<pid>/environ to act like /proc/<pid>/mem since
(mm->env_start + src) will point and read from another VMA.
There are two fixes here plus some code cleaning:
1) Fix the overflow by checking if the offset that was converted to
unsigned long will always point to the [mm->env_start, mm->env_end]
address range.
2) Remove the truncation that was made to the result of the check,
storing the result in 'int this_len' will alter its value and we can
not depend on it.
For kernels that have commit
|
||
---|---|---|
.. | ||
array.c | ||
base.c | ||
cmdline.c | ||
consoles.c | ||
cpuinfo.c | ||
devices.c | ||
generic.c | ||
inode.c | ||
internal.h | ||
interrupts.c | ||
Kconfig | ||
kcore.c | ||
kmsg.c | ||
loadavg.c | ||
Makefile | ||
meminfo.c | ||
mmu.c | ||
namespaces.c | ||
nommu.c | ||
page.c | ||
proc_devtree.c | ||
proc_net.c | ||
proc_sysctl.c | ||
proc_tty.c | ||
root.c | ||
softirqs.c | ||
stat.c | ||
task_mmu.c | ||
task_nommu.c | ||
uptime.c | ||
version.c | ||
vmcore.c |