From patchwork Mon Oct 8 15:49:35 2018 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Wenwen Wang X-Patchwork-Id: 980645 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming-netdev@ozlabs.org Delivered-To: patchwork-incoming-netdev@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Authentication-Results: ozlabs.org; dmarc=pass (p=none dis=none) header.from=umn.edu Authentication-Results: ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=umn.edu header.i=@umn.edu header.b="jmhCyvZr"; dkim-atps=neutral Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 42TPv925YGz9s8r for ; Tue, 9 Oct 2018 02:49:57 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726522AbeJHXCL (ORCPT ); Mon, 8 Oct 2018 19:02:11 -0400 Received: from mta-p7.oit.umn.edu ([134.84.196.207]:36304 "EHLO mta-p7.oit.umn.edu" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726291AbeJHXCL (ORCPT ); Mon, 8 Oct 2018 19:02:11 -0400 Received: from localhost (unknown [127.0.0.1]) by mta-p7.oit.umn.edu (Postfix) with ESMTP id EEFAA1044 for ; Mon, 8 Oct 2018 15:49:48 +0000 (UTC) X-Virus-Scanned: amavisd-new at umn.edu Received: from mta-p7.oit.umn.edu ([127.0.0.1]) by localhost (mta-p7.oit.umn.edu [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id iEmRvnC1tmhe for ; Mon, 8 Oct 2018 10:49:48 -0500 (CDT) Received: from mail-io1-f71.google.com (mail-io1-f71.google.com [209.85.166.71]) (using TLSv1.2 with cipher AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mta-p7.oit.umn.edu (Postfix) with ESMTPS id BC90D1060 for ; Mon, 8 Oct 2018 10:49:48 -0500 (CDT) Received: by mail-io1-f71.google.com with SMTP id f64-v6so19604932ioa.8 for ; Mon, 08 Oct 2018 08:49:48 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=umn.edu; s=google; h=from:to:cc:subject:date:message-id; bh=G3hHQo/9jnZpYEQeZQbO+SwMO1g3XEusnUb2WPTA/us=; b=jmhCyvZrEa0pPy8ROklYbzHOGlORLRakQExGaQmP64fUpRYrQ0AKFoReJNavFBa91T LEZ2gsmP0uB4531aLGPXAQwc3uZpwq6sNbKDkCTTgxjigG9ExiXEHQs+jVspiBxqvGxj kGyPo4nzo+DJ7iR6tFK5H7UEGzW6Exd8GeLieWQTrTtINdef4f4OZDePMKEbl3111NKm 1RCQJmZMzQXTUBFbpglBoD7apZ7/Th1sxZopMgw8UwwlZ+lRWj109SnxMOhes26Nz1hy K98QzMHV64FrhjMVePO8QAxbtbwgOYcqrRmUfLfVA1Bs8ByG16VPby8HMYE/txdfsLk8 jjQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=G3hHQo/9jnZpYEQeZQbO+SwMO1g3XEusnUb2WPTA/us=; b=X44II1St7TsaWwL0C5C3XKy9sL30ceQuD+JiMENL56W6bYwNEo6Z+0D5dWrY2poQHN Ee8ziAEnZbsBw1mxL2f+Hxpzgv+G9RqgSOnjBYYap13T44atFqhAgALuCncVBzeNEMRw s9xw+QxJkNFG00HMVT1kTsg42vUklV/mdhuKemu3qOZpeJEPBw98bgwddBHFme+CT+8C 9E9uN/ddy3v3GxWvYoI67eZ/AULs7lg093SoPwN0k7olPPtMrZ6/fSq+UR66La5fQ4Lf ghI9FSgu+1+HUKcWQ5tp37tMY6PaFP1q9MteaoGsnbT5qq+ke0LaU+NSAgaIvF8/gveq lB9Q== X-Gm-Message-State: ABuFfoht0k0ZslfsY0FlIxWehhBULqDwAjnzNtniu1893ZeBwmrEiC7m 0xQtsO7udtk9yz3S1XhifOioMp5jrj7TfV2PlCSKVkDO/R6BJHEHPiMKly0kRSE25G+qAZSNypd 8V0OU9TTvVpKUuxA6Hoiq X-Received: by 2002:a24:7f52:: with SMTP id r79-v6mr13436307itc.100.1539013788328; Mon, 08 Oct 2018 08:49:48 -0700 (PDT) X-Google-Smtp-Source: ACcGV60UAx+tgiIzpG74zOdIxt97rHdhBO5amSulvjuAVdihtCfgfChgKuJwluiQaW9VXx16JPVnSQ== X-Received: by 2002:a24:7f52:: with SMTP id r79-v6mr13436286itc.100.1539013788064; Mon, 08 Oct 2018 08:49:48 -0700 (PDT) Received: from cs-u-cslp16.cs.umn.edu (cs-u-cslp16.cs.umn.edu. [134.84.121.95]) by smtp.gmail.com with ESMTPSA id k5-v6sm4563516ita.14.2018.10.08.08.49.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 08 Oct 2018 08:49:47 -0700 (PDT) From: Wenwen Wang To: Wenwen Wang Cc: Kangjie Lu , "David S. Miller" , Florian Fainelli , Kees Cook , Andrew Lunn , Edward Cree , Ilya Lesokhin , Yury Norov , Alan Brady , Stephen Hemminger , netdev@vger.kernel.org (open list:NETWORKING [GENERAL]), linux-kernel@vger.kernel.org (open list) Subject: [PATCH] ethtool: fix a privilege escalation bug Date: Mon, 8 Oct 2018 10:49:35 -0500 Message-Id: <1539013777-1625-1-git-send-email-wang6495@umn.edu> X-Mailer: git-send-email 2.7.4 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org In dev_ethtool(), the eth command 'ethcmd' is firstly copied from the use-space buffer 'useraddr' and checked to see whether it is ETHTOOL_PERQUEUE. If yes, the sub-command 'sub_cmd' is further copied from the user space. Otherwise, 'sub_cmd' is the same as 'ethcmd'. Next, according to 'sub_cmd', a permission check is enforced through the function ns_capable(). For example, the permission check is required if 'sub_cmd' is ETHTOOL_SCOALESCE, but it is not necessary if 'sub_cmd' is ETHTOOL_GCOALESCE, as suggested in the comment "Allow some commands to be done by anyone". The following execution invokes different handlers according to 'ethcmd'. Specifically, if 'ethcmd' is ETHTOOL_PERQUEUE, ethtool_set_per_queue() is called. In ethtool_set_per_queue(), the kernel object 'per_queue_opt' is copied again from the user-space buffer 'useraddr' and 'per_queue_opt.sub_command' is used to determine which operation should be performed. Given that the buffer 'useraddr' is in the user space, a malicious user can race to change the sub-command between the two copies. In particular, the attacker can supply ETHTOOL_PERQUEUE and ETHTOOL_GCOALESCE to bypass the permission check in dev_ethtool(). Then before ethtool_set_per_queue() is called, the attacker changes ETHTOOL_GCOALESCE to ETHTOOL_SCOALESCE. In this way, the attacker can bypass the permission check and execute ETHTOOL_SCOALESCE. This patch enforces a check in ethtool_set_per_queue() after the second copy from 'useraddr'. If the sub-command is different from the one obtained in the first copy in dev_ethtool(), an error code EINVAL will be returned. Signed-off-by: Wenwen Wang Reviewed-by: Michal Kubecek --- net/core/ethtool.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/core/ethtool.c b/net/core/ethtool.c index c9993c6..ccb337e 100644 --- a/net/core/ethtool.c +++ b/net/core/ethtool.c @@ -2462,13 +2462,17 @@ static int ethtool_set_per_queue_coalesce(struct net_device *dev, return ret; } -static int ethtool_set_per_queue(struct net_device *dev, void __user *useraddr) +static int ethtool_set_per_queue(struct net_device *dev, + void __user *useraddr, u32 sub_cmd) { struct ethtool_per_queue_op per_queue_opt; if (copy_from_user(&per_queue_opt, useraddr, sizeof(per_queue_opt))) return -EFAULT; + if (per_queue_opt.sub_command != sub_cmd) + return -EINVAL; + switch (per_queue_opt.sub_command) { case ETHTOOL_GCOALESCE: return ethtool_get_per_queue_coalesce(dev, useraddr, &per_queue_opt); @@ -2838,7 +2842,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr) rc = ethtool_get_phy_stats(dev, useraddr); break; case ETHTOOL_PERQUEUE: - rc = ethtool_set_per_queue(dev, useraddr); + rc = ethtool_set_per_queue(dev, useraddr, sub_cmd); break; case ETHTOOL_GLINKSETTINGS: rc = ethtool_get_link_ksettings(dev, useraddr);