• Wenwen Wang's avatar
    virt: vbox: Only copy_from_user the request-header once · bd23a726
    Wenwen Wang authored
    In vbg_misc_device_ioctl(), the header of the ioctl argument is copied from
    the userspace pointer 'arg' and saved to the kernel object 'hdr'. Then the
    'version', 'size_in', and 'size_out' fields of 'hdr' are verified.
    
    Before this commit, after the checks a buffer for the entire request would
    be allocated and then all data including the verified header would be
    copied from the userspace 'arg' pointer again.
    
    Given that the 'arg' pointer resides in userspace, a malicious userspace
    process can race to change the data pointed to by 'arg' between the two
    copies. By doing so, the user can bypass the verifications on the ioctl
    argument.
    
    This commit fixes this by using the already checked copy of the header
    to fill the header part of the allocated buffer and only copying the
    remainder of the data from userspace.
    Signed-off-by: Wenwen Wang's avatarWenwen Wang <wang6495@umn.edu>
    Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
    Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
    bd23a726
vboxguest_linux.c 12.2 KB