1 /*
2 * Copyright (c) 2017 Richard Palethorpe <rpalethorpe@suse.com>
3 * Copyright (c) 2012, Kees Cook <keescook@chromium.org>
4 *
5 * This program is free software: you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation, either version 2 of the License, or
8 * (at your option) any later version.
9 *
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
14 *
15 * You should have received a copy of the GNU General Public License
16 * along with this program. If not, see <http://www.gnu.org/licenses/>.
17 */
18 /*
19 * Check that memory after the string terminator in all the utsname fields has
20 * been zeroed. cve-2012-0957 leaked kernel memory through the release field
21 * when the UNAME26 personality was set.
22 *
23 * Thanks to Kees Cook for the original proof of concept:
24 * http://www.securityfocus.com/bid/55855/info
25 */
26
27 #include <string.h>
28 #include <sys/utsname.h>
29 #include "tst_test.h"
30 #include "lapi/personality.h"
31
32 static struct utsname saved_buf;
33
check_field(char * bytes,char * saved_bytes,size_t length,char * field)34 static int check_field(char *bytes, char *saved_bytes, size_t length,
35 char *field)
36 {
37 size_t i = strlen(bytes) + 1;
38
39 for (; i < length; i++) {
40 if (bytes[i] && (bytes[i] != saved_bytes[i])) {
41 tst_res(TFAIL, "Bytes leaked in %s!", field);
42 return 1;
43 }
44 }
45 return 0;
46 }
47
48
try_leak_bytes(unsigned int test_nr)49 static void try_leak_bytes(unsigned int test_nr)
50 {
51 struct utsname buf;
52
53 memset(&buf, 0, sizeof(buf));
54
55 if (uname(&buf))
56 tst_brk(TBROK | TERRNO, "Call to uname failed");
57
58 if (!test_nr)
59 memcpy(&saved_buf, &buf, sizeof(saved_buf));
60
61 #define CHECK_FIELD(field_name) \
62 (check_field(buf.field_name, saved_buf.field_name, \
63 ARRAY_SIZE(buf.field_name), #field_name))
64
65 if (!(CHECK_FIELD(release) |
66 CHECK_FIELD(sysname) |
67 CHECK_FIELD(nodename) |
68 CHECK_FIELD(version) |
69 CHECK_FIELD(machine) |
70 #ifdef HAVE_STRUCT_UTSNAME_DOMAINNAME
71 CHECK_FIELD(domainname) |
72 #endif
73 0)) {
74 tst_res(TPASS, "No bytes leaked");
75 }
76 #undef CHECK_FIELD
77 }
78
run(unsigned int test_nr)79 static void run(unsigned int test_nr)
80 {
81 if (!test_nr) {
82 tst_res(TINFO, "Calling uname with default personality");
83 } else {
84 SAFE_PERSONALITY(PER_LINUX | UNAME26);
85 tst_res(TINFO, "Calling uname with UNAME26 personality");
86 }
87
88 try_leak_bytes(test_nr);
89 }
90
91 static struct tst_test test = {
92 .test = run,
93 .tcnt = 2,
94 };
95