freebsd security - Nov 2016 - [Bug 214488] mqueuefs mq_setattr() leaks stack memory

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

            Bug ID: 214488
           Summary: mqueuefs mq_setattr() leaks stack memory
           Product: Base System
           Version: CURRENT
          Hardware: Any
                OS: Any
            Status: New
          Severity: Affects Only Me
          Priority: ---
         Component: kern
          Assignee: freebsd-bugs at FreeBSD.org
          Reporter: vlad902+spam at gmail.com
                CC: freebsd-security at FreeBSD.org

Created attachment 176971
  -->
https://bugs.freebsd.org/bugzilla/attachment.cgi?id=176971&action=edit
Example trigger

In kern/uipc_mqueue.c, sys_kmq_setattr() calls kern_kmq_setattr() to fill out a
struct mq_attr before copying it back to userland; however, kern_kmq_setattr()
does not zero the struct or clear the __reserved field, leaking 4 words worth
of uninitialized stack memory. The same goes for freebsd32_kmq_setattr except
it's mq_attr_to32() that does not clear __reserved in struct mq_attr32.

The mqueuefs kernel module needs to be loaded to reach this code. Example code
is attached to dump leaked memory.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

Kubilay Kocak <koobs at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-qa, security
              Flags|                            |mfc-stable9?,
                   |                            |mfc-stable10?,
                   |                            |mfc-stable11?
             Status|New                         |Open
           Assignee|freebsd-bugs at FreeBSD.org    |secteam at FreeBSD.org

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

--- Comment #1 from commit-hook at freebsd.org ---
A commit references this bug:

Author: kib
Date: Mon Nov 14 13:20:10 UTC 2016
New revision: 308642
URL: https://svnweb.freebsd.org/changeset/base/308642

Log:
  Initialize reserved bytes in struct mq_attr and its 32compat
  counterpart, to avoid kernel stack content leak in kmq_setattr(2)
  syscall.  Also slightly simplify the checks around copyout()s.

  Reported by:  Vlad Tsyrklevich <vlad902+spam at gmail.com>
  PR:   214488
  MFC after:    1 week

Changes:
  head/sys/kern/uipc_mqueue.c

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

Kubilay Kocak <koobs at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|secteam at FreeBSD.org         |kib at FreeBSD.org
           Keywords|needs-qa                    |
             Status|Open                        |In Progress
                 CC|                            |secteam at FreeBSD.org

--- Comment #2 from Kubilay Kocak <koobs at FreeBSD.org> ---
Assign to committer resolving. Pending MFC

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

--- Comment #3 from Kubilay Kocak <koobs at FreeBSD.org> ---
@Konstantin If this needs an SA or other post-commit actions, please re-assign
as necessary.

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

--- Comment #4 from commit-hook at freebsd.org ---
A commit references this bug:

Author: kib
Date: Mon Nov 21 10:44:40 UTC 2016
New revision: 308918
URL: https://svnweb.freebsd.org/changeset/base/308918

Log:
  MFC r308642:
  Initialize reserved bytes in struct mq_attr.

  PR:   214488

Changes:
_U  stable/11/
  stable/11/sys/kern/uipc_mqueue.c

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

--- Comment #5 from commit-hook at freebsd.org ---
A commit references this bug:

Author: kib
Date: Mon Nov 21 10:47:38 UTC 2016
New revision: 308919
URL: https://svnweb.freebsd.org/changeset/base/308919

Log:
  MFC r308642:
  Initialize reserved bytes in struct mq_attr.

  PR:   214488

Changes:
_U  stable/10/
  stable/10/sys/kern/uipc_mqueue.c

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

--- Comment #6 from commit-hook at freebsd.org ---
A commit references this bug:

Author: kib
Date: Mon Nov 21 10:49:37 UTC 2016
New revision: 308920
URL: https://svnweb.freebsd.org/changeset/base/308920

Log:
  MFC r308642:
  Initialize reserved bytes in struct mq_attr.

  PR:   214488

Changes:
_U  stable/9/
_U  stable/9/sys/
  stable/9/sys/kern/uipc_mqueue.c

-- 
You are receiving this mail because:
You are on the CC list for the bug.

https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=214488

Konstantin Belousov <kib at FreeBSD.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|In Progress                 |Closed
         Resolution|---                         |FIXED

-- 
You are receiving this mail because:
You are on the CC list for the bug.