From 7fc7c96d6e3ccc791b459d8689aae32e11860bac Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Wed, 3 Jun 2020 07:41:02 +0200 Subject: [PATCH] fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() (CVE-2020-10732) --- debian/changelog | 2 + ...allocate-initialized-memory-in-fill_.patch | 41 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 44 insertions(+) create mode 100644 debian/patches/bugfix/all/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch diff --git a/debian/changelog b/debian/changelog index b3b67d37b..e969253ab 100644 --- a/debian/changelog +++ b/debian/changelog @@ -10,6 +10,8 @@ linux (4.19.118-2+deb10u1) UNRELEASED; urgency=medium * scsi: sg: add sg_remove_request in sg_write (CVE-2020-12770) * USB: gadget: fix illegal array access in binding with UDC (CVE-2020-13143) * netlabel: cope with NULL catmap (CVE-2020-10711) + * fs/binfmt_elf.c: allocate initialized memory in fill_thread_core_info() + (CVE-2020-10732) -- Salvatore Bonaccorso Thu, 28 May 2020 23:02:30 +0200 diff --git a/debian/patches/bugfix/all/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch b/debian/patches/bugfix/all/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch new file mode 100644 index 000000000..fc4ac93cb --- /dev/null +++ b/debian/patches/bugfix/all/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch @@ -0,0 +1,41 @@ +From: Alexander Potapenko +Date: Wed, 27 May 2020 22:20:52 -0700 +Subject: fs/binfmt_elf.c: allocate initialized memory in + fill_thread_core_info() +Origin: https://git.kernel.org/linus/1d605416fb7175e1adf094251466caa52093b413 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2020-10732 + +KMSAN reported uninitialized data being written to disk when dumping +core. As a result, several kilobytes of kmalloc memory may be written +to the core file and then read by a non-privileged user. + +Reported-by: sam +Signed-off-by: Alexander Potapenko +Signed-off-by: Andrew Morton +Acked-by: Kees Cook +Cc: Al Viro +Cc: Alexey Dobriyan +Cc: +Link: http://lkml.kernel.org/r/20200419100848.63472-1-glider@google.com +Link: https://github.com/google/kmsan/issues/76 +Signed-off-by: Linus Torvalds +--- + fs/binfmt_elf.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 13f25e241ac4..25d489bc9453 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -1733,7 +1733,7 @@ static int fill_thread_core_info(struct elf_thread_core_info *t, + (!regset->active || regset->active(t->task, regset) > 0)) { + int ret; + size_t size = regset_size(t->task, regset); +- void *data = kmalloc(size, GFP_KERNEL); ++ void *data = kzalloc(size, GFP_KERNEL); + if (unlikely(!data)) + return 0; + ret = regset->get(t->task, regset, +-- +2.27.0.rc0 + diff --git a/debian/patches/series b/debian/patches/series index a7b82e3b0..10d611c8a 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -307,5 +307,6 @@ bugfix/x86/kvm-svm-fix-potential-memory-leak-in-svm_cpu_init.patch bugfix/all/scsi-sg-add-sg_remove_request-in-sg_write.patch bugfix/all/usb-gadget-fix-illegal-array-access-in-binding-with-.patch bugfix/all/netlabel-cope-with-NULL-catmap.patch +bugfix/all/fs-binfmt_elf.c-allocate-initialized-memory-in-fill_.patch # ABI maintenance