Openwall GNU/*/Linux - a small security-enhanced Linux distro for servers
[<prev] [next>] [day] [month] [year] [list]
Date: Thu, 18 Apr 2019 21:35:40 +0800
From: Fuqian Huang <huangfq.daxian@...il.com>
To: oss-security@...ts.openwall.com
Subject: Linux kernel < 4.14.111 drivers/scsi/cxgbi/cxgb4i/cxgb4i.c kernel
 address dumps to user space

In drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:299,
send_act_open_req will dump the address of csk to dmesg
which allows local user to read kernel address via dmesg.

static void send_act_open_req(struct cxgbi_sock *csk, struct sk_buff *skb,
                struct l2t_entry *e)
{
    ...
    pr_info_ipaddr("t%d csk 0x%p,%u,0x%lx,%u, rss_qid %u.\n",
               (&csk->saddr), (&csk->daddr),
               CHELSIO_CHIP_VERSION(lldi->adapter_type), csk,
               csk->state, csk->flags, csk->atid, csk->rss_qid);
    ...
}


In drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:1792,
cxgb4i_ofld_init will dump the address of cdev to dmesg
which allows local user to read kernel address via dmesg.

static int cxgb4i_ofld_init(struct cxgbi_device *cdev)
{
    ...
    pr_info("cdev 0x%p, offload up, added.\n", cdev);
    ...
}

In drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2047,
t4_uld_add will dump the address of cdev to dmesg
which allows local user to read kernel address via dmesg.

static void *t4_uld_add(const struct cxgb4_lld_info *lldi)
{
    ...
    pr_info("cdev 0x%p,%s, pfvf %u.\n",
        cdev, lldi->ports[0]->name, cdev->pfvf);
    ...
}

In drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2129
and drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2132
and drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2136
and drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2139
and drivers/scsi/cxgbi/cxgb4i/cxgb4i.c:2143,
t4_uld_state_change will dump the address of cdev to dmesg
which allows local user to read kernel address via dmesg.

static int t4_uld_state_change(void *handle, enum cxgb4_state state)
{
    struct cxgbi_device *cdev = handle;

    switch (state) {
    case CXGB4_STATE_UP:
        pr_info("cdev 0x%p, UP.\n", cdev);
        break;
    case CXGB4_STATE_START_RECOVERY:
        pr_info("cdev 0x%p, RECOVERY.\n", cdev);
        /* close all connections */
        break;
    case CXGB4_STATE_DOWN:
        pr_info("cdev 0x%p, DOWN.\n", cdev);
        break;
    case CXGB4_STATE_DETACH:
        pr_info("cdev 0x%p, DETACH.\n", cdev);
        cxgbi_device_unregister(cdev);
        break;
    default:
        pr_info("cdev 0x%p, unknown state %d.\n", cdev, state);
        break;
    }
    return 0;
}

Powered by blists - more mailing lists

Your e-mail address:

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.