diff options
| author | Kees Cook <keescook@chromium.org> | 2020-07-02 14:43:59 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-07-16 08:16:45 +0200 |
| commit | 314ac273f005b8077c272a9439ab21bd74dc80d2 (patch) | |
| tree | 83a95e1b38c7dc6a95df415e257577aa81d8cedf /kernel/module.c | |
| parent | 0d5d9413a692a2cc0f8848c6d93d7c487caececf (diff) | |
| download | linux-stable-314ac273f005b8077c272a9439ab21bd74dc80d2.tar.gz linux-stable-314ac273f005b8077c272a9439ab21bd74dc80d2.tar.bz2 linux-stable-314ac273f005b8077c272a9439ab21bd74dc80d2.zip | |
module: Do not expose section addresses to non-CAP_SYSLOG
commit b25a7c5af9051850d4f3d93ca500056ab6ec724b upstream.
The printing of section addresses in /sys/module/*/sections/* was not
using the correct credentials to evaluate visibility.
Before:
# cat /sys/module/*/sections/.*text
0xffffffffc0458000
...
# capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
0xffffffffc0458000
...
After:
# cat /sys/module/*/sections/*.text
0xffffffffc0458000
...
# capsh --drop=CAP_SYSLOG -- -c "cat /sys/module/*/sections/.*text"
0x0000000000000000
...
Additionally replaces the existing (safe) /proc/modules check with
file->f_cred for consistency.
Reported-by: Dominik Czarnota <dominik.czarnota@trailofbits.com>
Fixes: be71eda5383f ("module: Fix display of wrong module .text address")
Cc: stable@vger.kernel.org
Tested-by: Jessica Yu <jeyu@kernel.org>
Acked-by: Jessica Yu <jeyu@kernel.org>
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'kernel/module.c')
| -rw-r--r-- | kernel/module.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/kernel/module.c b/kernel/module.c index f58af5eb9295..6baa1080cdb7 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -1527,8 +1527,8 @@ static ssize_t module_sect_read(struct file *file, struct kobject *kobj, if (pos != 0) return -EINVAL; - return sprintf(buf, "0x%px\n", kptr_restrict < 2 ? - (void *)sattr->address : NULL); + return sprintf(buf, "0x%px\n", + kallsyms_show_value(file->f_cred) ? (void *)sattr->address : NULL); } static void free_sect_attrs(struct module_sect_attrs *sect_attrs) @@ -4394,7 +4394,7 @@ static int modules_open(struct inode *inode, struct file *file) if (!err) { struct seq_file *m = file->private_data; - m->private = kallsyms_show_value(current_cred()) ? NULL : (void *)8ul; + m->private = kallsyms_show_value(file->f_cred) ? NULL : (void *)8ul; } return err; |