Files
twx-linux/include/linux
Willy Tarreau 6f1abf8628 proc: do not access cmdline nor environ from file-backed areas
commit 7f7ccc2ccc upstream.

proc_pid_cmdline_read() and environ_read() directly access the target
process' VM to retrieve the command line and environment. If this
process remaps these areas onto a file via mmap(), the requesting
process may experience various issues such as extra delays if the
underlying device is slow to respond.

Let's simply refuse to access file-backed areas in these functions.
For this we add a new FOLL_ANON gup flag that is passed to all calls
to access_remote_vm(). The code already takes care of such failures
(including unmapped areas). Accesses via /proc/pid/mem were not
changed though.

This was assigned CVE-2018-1120.

Note for stable backports: the patch may apply to kernels prior to 4.11
but silently miss one location; it must be checked that no call to
access_remote_vm() keeps zero as the last argument.

Reported-by: Qualys Security Advisory <qsa@qualys.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Andy Lutomirski <luto@amacapital.net>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: stable@vger.kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2018-05-19 10:27:00 +02:00
..
2017-10-08 10:26:06 +02:00
2018-04-24 09:34:18 +02:00
2017-06-14 15:06:00 +02:00
2018-01-17 09:38:57 +01:00
2018-02-28 10:18:33 +01:00
2017-08-06 18:59:43 -07:00
2017-07-15 12:16:11 +02:00
2017-05-14 14:00:22 +02:00
2017-07-12 15:01:02 +02:00
2017-08-06 18:59:43 -07:00
2018-04-24 09:34:12 +02:00
2016-10-20 15:51:28 +11:00
2017-08-24 17:12:19 -07:00
2016-10-19 11:36:22 -06:00
2017-08-24 17:12:21 -07:00
2016-10-14 11:36:59 -07:00
2017-08-30 10:21:40 +02:00
2017-01-19 20:17:59 +01:00
2017-04-21 09:31:21 +02:00
2017-12-25 14:23:37 +01:00