| Message ID | 20190811235507.GA9587@embeddedor (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | [next] ima: ima_modsig: Fix use-after-free bug in ima_read_modsig | expand |
Hi Gustavo, On Sun, 2019-08-11 at 18:55 -0500, Gustavo A. R. Silva wrote: > hdr is being freed and then dereferenced by accessing hdr->pkcs7_msg > > Fix this by copying the value returned by PTR_ERR(hdr->pkcs7_msg) into > automatic variable err for its safe use after freeing hdr. > > Addresses-Coverity-ID: 1485813 ("Read from pointer after free") > Fixes: 39b07096364a ("ima: Implement support for module-style appended signatures") > Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> This bug was reported Julia and addressed by Thiago on 8/7. If you would like to add your Review/Tested-by, the patch can be found in the linux-integrity next-queued-testing branch. thanks, Mimi
On 8/28/19 8:50 AM, Mimi Zohar wrote: > Hi Gustavo, > > On Sun, 2019-08-11 at 18:55 -0500, Gustavo A. R. Silva wrote: >> hdr is being freed and then dereferenced by accessing hdr->pkcs7_msg >> >> Fix this by copying the value returned by PTR_ERR(hdr->pkcs7_msg) into >> automatic variable err for its safe use after freeing hdr. >> >> Addresses-Coverity-ID: 1485813 ("Read from pointer after free") >> Fixes: 39b07096364a ("ima: Implement support for module-style appended signatures") >> Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> > > This bug was reported Julia and addressed by Thiago on 8/7. If you > would like to add your Review/Tested-by, the patch can be found in the > linux-integrity next-queued-testing branch. > I'm glad this is fixed now. :) Yeah, you can add my: Reviewed-by: Gustavo A. R. Silva <gustavo@embeddedor.com> Thanks -- Gustavo
diff --git a/security/integrity/ima/ima_modsig.c b/security/integrity/ima/ima_modsig.c index c412e31d1714..e681d4326145 100644 --- a/security/integrity/ima/ima_modsig.c +++ b/security/integrity/ima/ima_modsig.c @@ -91,8 +91,9 @@ int ima_read_modsig(enum ima_hooks func, const void *buf, loff_t buf_len, hdr->pkcs7_msg = pkcs7_parse_message(buf + buf_len, sig_len); if (IS_ERR(hdr->pkcs7_msg)) { + int err = PTR_ERR(hdr->pkcs7_msg); kfree(hdr); - return PTR_ERR(hdr->pkcs7_msg); + return err; } memcpy(hdr->raw_pkcs7, buf + buf_len, sig_len);
hdr is being freed and then dereferenced by accessing hdr->pkcs7_msg Fix this by copying the value returned by PTR_ERR(hdr->pkcs7_msg) into automatic variable err for its safe use after freeing hdr. Addresses-Coverity-ID: 1485813 ("Read from pointer after free") Fixes: 39b07096364a ("ima: Implement support for module-style appended signatures") Signed-off-by: Gustavo A. R. Silva <gustavo@embeddedor.com> --- security/integrity/ima/ima_modsig.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)