Kees Cook b66c598401 exec: do not leave bprm->interp on stack ... If a series of scripts are executed, each triggering module loading via unprintable bytes in the script header, kernel stack contents can leak into the command line. Normally execution of binfmt_script and binfmt_misc happens recursively. However, when modules are enabled, and unprintable bytes exist in the bprm->buf, execution will restart after attempting to load matching binfmt modules. Unfortunately, the logic in binfmt_script and binfmt_misc does not expect to get restarted. They leave bprm->interp pointing to their local stack. This means on restart bprm->interp is left pointing into unused stack memory which can then be copied into the userspace argv areas. After additional study, it seems that both recursion and restart remains the desirable way to handle exec with scripts, misc, and modules. As such, we need to protect the changes to interp. This changes the logic to require allocation for any changes to the bprm->interp. To avoid adding a new kmalloc to every exec, the default value is left as-is. Only when passing through binfmt_script or binfmt_misc does an allocation take place. For a proof of concept, see DoTest.sh from: http://www.halfdog.net/Security/2012/LinuxKernelBinfmtScriptStackDataDisclosure/ Signed-off-by: Kees Cook <keescook@chromium.org> Cc: halfdog <me@halfdog.net> Cc: P J P <ppandit@redhat.com> Cc: Alexander Viro <viro@zeniv.linux.org.uk> Cc: <stable@vger.kernel.org> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>		2012-12-20 17:40:19 -08:00
..
9p	The following changes since commit 4cbe5a555f:	2012-10-12 09:59:23 +09:00
adfs
affs
afs
autofs4	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2012-12-17 15:44:47 -08:00
befs
bfs
btrfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs	2012-12-18 09:42:05 -08:00
cachefiles
ceph	ceph: fix dentry reference leak in ceph_encode_fh()	2012-12-18 15:02:11 -08:00
cifs	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
coda
configfs	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
cramfs
debugfs	fs/debugsfs: remove unnecessary inode->i_private initialization	2012-11-15 17:46:42 -08:00
devpts	TTY: devpts, document devpts inode operations	2012-10-22 16:50:13 -07:00
dlm	dlm: fix lvb invalidation conditions	2012-11-16 11:20:42 -06:00
ecryptfs
efs
exofs	exofs: don't leak io_state and pages on read error	2012-12-14 12:17:32 +02:00
exportfs	fs, exportfs: add exportfs_encode_inode_fh() helper	2012-12-17 17:15:27 -08:00
ext2	ext2: fix return values on parse_options() failure	2012-10-09 23:23:53 +02:00
ext3	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
ext4	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
fat	fs/fat: strip "cp" prefix from codepage in display	2012-12-17 17:15:22 -08:00
freevxfs
fscache
fuse	Merge branch 'akpm' (Andrew's patch-bomb)	2012-12-17 20:58:12 -08:00
gfs2	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
hfs
hfsplus
hostfs	Merge branch 'for-linus-37rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/uml	2012-10-10 11:15:20 +09:00
hpfs	hpfs: drop lock/unlock super	2012-10-09 23:33:38 -04:00
hppfs	pidns: Use task_active_pid_ns where appropriate	2012-11-19 05:59:09 -08:00
hugetlbfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2012-12-13 12:00:02 -08:00
isofs	tmpfs,ceph,gfs2,isofs,reiserfs,xfs: fix fh_len checking	2012-10-09 23:33:55 -04:00
jbd	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial	2012-12-13 12:00:02 -08:00
jbd2	There are two major features for this merge window. The first is	2012-12-16 17:33:01 -08:00
jffs2	jffs2: hold erase_completion_lock on exit	2012-11-18 11:59:01 +02:00
jfs	jfs: Fix FITRIM argument handling	2012-10-17 09:18:38 -05:00
lockd	lockd: Remove BUG_ON()s from fs/lockd/clntproc.c	2012-11-04 14:43:40 -05:00
logfs	Fix misspellings of "whether" in comments.	2012-11-19 14:31:35 +01:00
minix
ncpfs	propagate name change to comments in kernel source	2012-12-06 10:39:54 +01:00
nfs	NFS client updates for Linux 3.8	2012-12-18 09:36:34 -08:00
nfs_common
nfsd	UAPI Disintegration 2012-10-09	2012-10-09 18:35:22 -04:00
nilfs2	mm: redefine address_space.assoc_mapping	2012-12-11 17:22:26 -08:00
nls
notify	fs, fanotify: add @mflags field to fanotify output	2012-12-17 17:15:28 -08:00
ntfs
ocfs2	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
omfs	omfs: convert to use beXX_add_cpu()	2012-10-06 03:05:31 +09:00
openpromfs
proc	Merge branch 'akpm' (Andrew's patch-bomb)	2012-12-17 20:58:12 -08:00
pstore	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
qnx4
qnx6
quota	quota: Use the pre-processor to compile out quotactl_cmd_write when !CONFIG_BLOCK	2012-12-13 16:33:24 +01:00
ramfs
reiserfs	reiserfs: Move quota calls out of write lock	2012-11-19 21:34:33 +01:00
romfs
squashfs
sysfs	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace	2012-12-17 15:44:47 -08:00
sysv	sysv: drop lock/unlock super	2012-10-09 23:33:39 -04:00
ubifs	ubifs: use prandom_bytes	2012-12-17 17:15:26 -08:00
udf	udf: remove un-needed variable from inode_getblk	2012-12-13 16:33:23 +01:00
ufs	ufs: drop lock/unlock super	2012-10-09 23:33:39 -04:00
xfs	xfs: fix sparse reported log CRC endian issue	2012-12-03 12:10:59 -06:00
aio.c
anon_inodes.c
attr.c	userns: Allow chown and setgid preservation	2012-11-20 04:17:24 -08:00
bad_inode.c	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
binfmt_aout.c	get rid of pt_regs argument of ->load_binary()	2012-11-28 21:53:38 -05:00
binfmt_elf.c	binfmt_elf: fix corner case kfree of uninitialized data	2012-12-17 17:15:19 -08:00
binfmt_elf_fdpic.c	get rid of pt_regs argument of ->load_binary()	2012-11-28 21:53:38 -05:00
binfmt_em86.c	exec: use -ELOOP for max recursion depth	2012-12-17 17:15:23 -08:00
binfmt_flat.c	get rid of pt_regs argument of ->load_binary()	2012-11-28 21:53:38 -05:00
binfmt_misc.c	exec: do not leave bprm->interp on stack	2012-12-20 17:40:19 -08:00
binfmt_script.c	exec: do not leave bprm->interp on stack	2012-12-20 17:40:19 -08:00
binfmt_som.c	get rid of pt_regs argument of ->load_binary()	2012-11-28 21:53:38 -05:00
bio-integrity.c
bio.c	vfs: fix: don't increase bio_slab_max if krealloc() fails	2012-10-22 22:00:26 +02:00
block_dev.c	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
buffer.c	fs/buffer.c: remove redundant initialization in alloc_page_buffers()	2012-12-12 17:38:35 -08:00
char_dev.c	char_dev: pin parent kobject	2012-10-22 08:50:37 +03:00
compat.c	vfs: define struct filename and have getname() return it	2012-10-12 20:14:55 -04:00
compat_binfmt_elf.c	coredump: extend core dump note section to contain file names of mapped files	2012-10-06 03:05:17 +09:00
compat_ioctl.c	Merge 3.7-rc3 into tty-next	2012-10-29 09:00:57 -07:00
coredump.c	do_coredump(): get rid of pt_regs argument	2012-11-29 00:01:25 -05:00
coredump.h	coredump: update coredump-related headers	2012-10-06 03:05:15 +09:00
dcache.c
dcookies.c
direct-io.c	direct-io: don't read inode->i_blkbits multiple times	2012-11-29 12:38:44 -08:00
drop_caches.c
eventfd.c	fs, eventfd: add procfs fdinfo helper	2012-12-17 17:15:27 -08:00
eventpoll.c	fs, epoll: add procfs fdinfo helper	2012-12-17 17:15:27 -08:00
exec.c	exec: do not leave bprm->interp on stack	2012-12-20 17:40:19 -08:00
fcntl.c	Fix F_DUPFD_CLOEXEC breakage	2012-10-09 15:52:31 +09:00
fhandle.c	Fix misspellings of "whether" in comments.	2012-11-19 14:31:35 +01:00
fifo.c
file.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/signal	2012-12-12 12:22:13 -08:00
file_table.c	lglock: add DEFINE_STATIC_LGLOCK()	2012-10-10 01:15:44 -04:00
filesystems.c	vfs: define struct filename and have getname() return it	2012-10-12 20:14:55 -04:00
fs-writeback.c	writeback: fix a typo in comment	2012-12-12 17:38:34 -08:00
fs_struct.c	kill daemonize()	2012-11-28 21:49:02 -05:00
generic_acl.c
inode.c	mm: redefine address_space.assoc_mapping	2012-12-11 17:22:26 -08:00
internal.h	writeback: put unused inodes to LRU after writeback completion	2012-11-26 17:41:24 -08:00
ioctl.c
ioprio.c
Kconfig	ext4: Remove CONFIG_EXT4_FS_XATTR	2012-12-10 16:30:43 -05:00
Kconfig.binfmt	coredump: make core dump functionality optional	2012-10-06 03:05:15 +09:00
libfs.c	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
locks.c	UAPI Disintegration 2012-10-09	2012-10-09 18:35:22 -04:00
Makefile	coredump: make core dump functionality optional	2012-10-06 03:05:15 +09:00
mbcache.c
mount.h	proc: Usable inode numbers for the namespace file descriptors.	2012-11-20 04:19:49 -08:00
mpage.c
namei.c	lookup_one_len: don't accept . and ..	2012-11-29 22:17:21 -05:00
namespace.c	userns: Require CAP_SYS_ADMIN for most uses of setns.	2012-12-14 16:12:03 -08:00
no-block.c
open.c	vfs: Allow chroot if you have CAP_SYS_CHROOT in your user namespace	2012-11-19 05:59:17 -08:00
pipe.c
pnode.c
pnode.h	vfs: Only support slave subtrees across different user namespaces	2012-11-19 05:59:20 -08:00
posix_acl.c
proc_namespace.c
read_write.c	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
read_write.h
readdir.c
select.c
seq_file.c	lseek: the "whence" argument is called "whence"	2012-12-17 17:15:12 -08:00
signalfd.c	fs, epoll: add procfs fdinfo helper	2012-12-17 17:15:27 -08:00
splice.c	writeback: remove nr_pages_dirtied arg from balance_dirty_pages_ratelimited_nr()	2012-12-11 17:22:21 -08:00
stack.c
stat.c
statfs.c
super.c	vfs: drop lock/unlock super	2012-10-09 23:33:39 -04:00
sync.c
timerfd.c
utimes.c
xattr.c	fs, xattr: fix bug when removing a name not in xattr list	2012-10-18 12:35:58 -07:00
xattr_acl.c	userns: Fix posix_acl_file_xattr_userns gid conversion	2012-10-12 13:16:48 -07:00