From d7f4f21608318a4d82a627efda3833174990597d Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sat, 30 Jun 2018 03:27:55 +0100 Subject: [PATCH] tracing: Check for no filter when processing event filters (CVE-2018-12714) --- debian/changelog | 1 + ...r-no-filter-when-processing-event-fi.patch | 61 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 63 insertions(+) create mode 100644 debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch diff --git a/debian/changelog b/debian/changelog index eb73f73b8..4729d9ef0 100644 --- a/debian/changelog +++ b/debian/changelog @@ -85,6 +85,7 @@ linux (4.17.3-1) UNRELEASED; urgency=medium * aufs: Update support patchset to aufs4.x-rcN-20180611 * debian/rules.d/scripts/mod/gendef.py: Use Python 3 * debian/rules: Fix pkg.linux.notools build profile + * tracing: Check for no filter when processing event filters (CVE-2018-12714) [ Romain Perier ] * [x86] amdgpu: Enable DCN 1.0 Raven family (Closes: #901349) diff --git a/debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch b/debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch new file mode 100644 index 000000000..b7fac2ec6 --- /dev/null +++ b/debian/patches/bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch @@ -0,0 +1,61 @@ +From: "Steven Rostedt (VMware)" +Date: Thu, 21 Jun 2018 13:20:53 -0400 +Subject: tracing: Check for no filter when processing event filters +Origin: https://git.kernel.org/linus/70303420b5721c38998cf987e6b7d30cc62d4ff1 +Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2018-12714 + +The syzkaller detected a out-of-bounds issue with the events filter code, +specifically here: + + prog[N].pred = NULL; /* #13 */ + prog[N].target = 1; /* TRUE */ + prog[N+1].pred = NULL; + prog[N+1].target = 0; /* FALSE */ +-> prog[N-1].target = N; + prog[N-1].when_to_branch = false; + +As that's the first reference to a "N-1" index, it appears that the code got +here with N = 0, which means the filter parser found no filter to parse +(which shouldn't ever happen, but apparently it did). + +Add a new error to the parsing code that will check to make sure that N is +not zero before going into this part of the code. If N = 0, then -EINVAL is +returned, and a error message is added to the filter. + +Cc: stable@vger.kernel.org +Fixes: 80765597bc587 ("tracing: Rewrite filter logic to be simpler and faster") +Reported-by: air icy +bugzilla url: https://bugzilla.kernel.org/show_bug.cgi?id=200019 +Signed-off-by: Steven Rostedt (VMware) +--- + kernel/trace/trace_events_filter.c | 10 +++++++++- + 1 file changed, 9 insertions(+), 1 deletion(-) + +diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c +index e1c818dbc0d7..0dceb77d1d42 100644 +--- a/kernel/trace/trace_events_filter.c ++++ b/kernel/trace/trace_events_filter.c +@@ -78,7 +78,8 @@ static const char * ops[] = { OPS }; + C(TOO_MANY_PREDS, "Too many terms in predicate expression"), \ + C(INVALID_FILTER, "Meaningless filter expression"), \ + C(IP_FIELD_ONLY, "Only 'ip' field is supported for function trace"), \ +- C(INVALID_VALUE, "Invalid value (did you forget quotes)?"), ++ C(INVALID_VALUE, "Invalid value (did you forget quotes)?"), \ ++ C(NO_FILTER, "No filter found"), + + #undef C + #define C(a, b) FILT_ERR_##a +@@ -550,6 +551,13 @@ predicate_parse(const char *str, int nr_parens, int nr_preds, + goto out_free; + } + ++ if (!N) { ++ /* No program? */ ++ ret = -EINVAL; ++ parse_error(pe, FILT_ERR_NO_FILTER, ptr - str); ++ goto out_free; ++ } ++ + prog[N].pred = NULL; /* #13 */ + prog[N].target = 1; /* TRUE */ + prog[N+1].pred = NULL; diff --git a/debian/patches/series b/debian/patches/series index d9ef5ef33..e277e6969 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -134,6 +134,7 @@ debian/i386-686-pae-pci-set-pci-nobios-by-default.patch bugfix/x86/virt-vbox-Only-copy_from_user-the-request-header-onc.patch # Fix exported symbol versions +bugfix/all/tracing-check-for-no-filter-when-processing-event-fi.patch bugfix/all/module-disable-matching-missing-version-crc.patch # Tools bug fixes