Linux Kernel Vmsplice Unchecked User-Pointer Dereference
13 Feb. 2008
Summary
A new vmsplice() system call was introduced in the 2.6.17 release of the Linux kernel. In the 2.6.23 kernel the system call functionality has been further extended resulting in two new critical vulnerabilities.
Vulnerable Systems:
* Linux version 2.6.23
* Linux version 2.6.24
Vulnerability #1
Inappropriate dereference of user-supplied memory pointers in the code beginning at line 1378 in the vmsplice_to_user() kernel
function (fs/splice.c):
The code lacks validation of these pointers (i.e. with access_ok()). The __splice_from_pipe() assumes these are valid user-memory pointers and never makes any verification of them. The function dereferences the pointers with __copy_to_user_inatomic() function (in pipe_to_user()) in order to write data to user-process memory in this case leading to possibility of arbitrary data (read from pipe) to arbitrary kernel memory.
Vulnerability #2
The copy_from_user_mmap_sem() function copies data from user-process memory with the use of __copy_from_user_inatomic() without validating user-supplied pointer with access_ok():
