From patchwork Wed Mar 18 17:39:08 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Shachar Raindel X-Patchwork-Id: 6042391 Return-Path: X-Original-To: patchwork-linux-rdma@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id 50991BF90F for ; Wed, 18 Mar 2015 17:39:48 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 65D25203EB for ; Wed, 18 Mar 2015 17:39:47 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 45E15203F7 for ; Wed, 18 Mar 2015 17:39:46 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754803AbbCRRjj (ORCPT ); Wed, 18 Mar 2015 13:39:39 -0400 Received: from mail-db3on0057.outbound.protection.outlook.com ([157.55.234.57]:6368 "EHLO emea01-db3-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1756202AbbCRRjh convert rfc822-to-8bit (ORCPT ); Wed, 18 Mar 2015 13:39:37 -0400 Received: from AM3PR05MB0935.eurprd05.prod.outlook.com (25.161.33.24) by AM3PR05MB0935.eurprd05.prod.outlook.com (25.161.33.24) with Microsoft SMTP Server (TLS) id 15.1.112.19; Wed, 18 Mar 2015 17:39:29 +0000 Received: from AM3PR05MB0935.eurprd05.prod.outlook.com ([25.161.33.24]) by AM3PR05MB0935.eurprd05.prod.outlook.com ([25.161.33.24]) with mapi id 15.01.0112.000; Wed, 18 Mar 2015 17:39:29 +0000 From: Shachar Raindel To: "oss-security@lists.openwall.com" , " (linux-rdma@vger.kernel.org)" CC: "stable@vger.kernel.org" Subject: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Thread-Topic: CVE-2014-8159 kernel: infiniband: uverbs: unprotected physical memory access Thread-Index: AdBhVdw7KUNdeyMeSpqluq47/RCydw== Date: Wed, 18 Mar 2015 17:39:08 +0000 Deferred-Delivery: Wed, 18 Mar 2015 17:38:58 +0000 Message-ID: Accept-Language: en-US Content-Language: en-US X-MS-Has-Attach: X-MS-TNEF-Correlator: x-originating-ip: [193.47.165.251] authentication-results: lists.openwall.com; dkim=none (message not signed) header.d=none; x-microsoft-antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:AM3PR05MB0935; x-microsoft-antispam-prvs: x-forefront-antispam-report: BMV:1; SFV:NSPM; SFS:(10009020)(6009001)(229853001)(54356999)(40100003)(46102003)(50986999)(19580405001)(230783001)(77156002)(2501003)(19580395003)(76576001)(33656002)(122556002)(62966003)(102836002)(15975445007)(66066001)(92566002)(74316001)(86362001)(2900100001)(87936001)(2656002); DIR:OUT; SFP:1101; SCL:1; SRVR:AM3PR05MB0935; H:AM3PR05MB0935.eurprd05.prod.outlook.com; FPR:; SPF:None; MLV:sfv; LANG:en; x-exchange-antispam-report-test: UriScan:; x-exchange-antispam-report-cfa-test: BCL:0; PCL:0; RULEID:(601004)(5005006)(5002010); SRVR:AM3PR05MB0935; BCL:0; PCL:0; RULEID:; SRVR:AM3PR05MB0935; x-forefront-prvs: 051900244E MIME-Version: 1.0 X-OriginatorOrg: Mellanox.com X-MS-Exchange-CrossTenant-originalarrivaltime: 18 Mar 2015 17:39:28.5865 (UTC) X-MS-Exchange-CrossTenant-fromentityheader: Hosted X-MS-Exchange-CrossTenant-id: a652971c-7d2e-4d9b-a6a4-d149256f461b X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM3PR05MB0935 Sender: linux-rdma-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-rdma@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=ham version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Hi, It was found that the Linux kernel's InfiniBand/RDMA subsystem did not properly sanitize input parameters while registering memory regions from user space via the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX device could use this flaw to crash the system or, potentially, escalate their privileges on the system. The issue has been assigned CVE-2014-8159. The issue exists in the InfiniBand/RDMA/iWARP drivers since Linux Kernel version 2.6.13. Mellanox OFED 2.4-1.0.4 fixes the issue. Available from: http://www.mellanox.com/page/products_dyn?product_family=26&mtag=linux_sw_drivers RedHat errata: https://access.redhat.com/security/cve/CVE-2014-8159 Canonical errata: http://people.canonical.com/~ubuntu-security/cve/2014/CVE-2014-8159.html Novell (Suse) bug tracking: https://bugzilla.novell.com/show_bug.cgi?id=914742 The following patch fixes the issue: --------------- 8< ------------------------------ From d4d68430d4a12c569e28b4f4468284ea22111186 Mon Sep 17 00:00:00 2001 From: Shachar Raindel Date: Sun, 04 Jan 2015 18:30:32 +0200 Subject: [PATCH] IB/core: Prevent integer overflow in ib_umem_get address arithmetic Properly verify that the resulting page aligned end address is larger than both the start address and the length of the memory area requested. Both the start and length arguments for ib_umem_get are controlled by the user. A misbehaving user can provide values which will cause an integer overflow when calculating the page aligned end address. This overflow can cause also miscalculation of the number of pages mapped, and additional logic issues. Signed-off-by: Shachar Raindel Signed-off-by: Jack Morgenstein Signed-off-by: Or Gerlitz --- -- To unsubscribe from this list: send the line "unsubscribe linux-rdma" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c index aec7a6a..8c014b5 100644 --- a/drivers/infiniband/core/umem.c +++ b/drivers/infiniband/core/umem.c @@ -99,6 +99,14 @@ if (dmasync) dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs); + /* + * If the combination of the addr and size requested for this memory + * region causes an integer overflow, return error. + */ + if ((PAGE_ALIGN(addr + size) <= size) || + (PAGE_ALIGN(addr + size) <= addr)) + return ERR_PTR(-EINVAL); + if (!can_do_mlock()) return ERR_PTR(-EPERM);