Linux Virtualization - Feb 2015 - vmci: read overrun bug in dg_dispatch_as_host() (drivers/misc/vmw_vmci/vmci_datagram.c)

Hello,

Our UC-KLEE tool discovered a memcpy() read overrun bug in dg_dispatch_as_host()
(drivers/misc/vmw_vmci/vmci_datagram.c). This bug may allow a malicious user to
leak private kernel heap data across the VMware VMCI interface (in a nearly
identical fashion to the OpenSSL Heartbleed vulnerability from 2014), but the
impact is probably minimal since this interface is only used for local
communication.

The bug occurs for the IOCTL_VMCI_DATAGRAM_SEND ioctl, and our tool reports the
following partial backtrace:
#0 memcpy ()
#1 dg_dispatch_as_host () at drivers/misc/vmw_vmci/vmci_datagram.c:245
#2 vmci_datagram_dispatch () at drivers/misc/vmw_vmci/vmci_datagram.c:347
#3 vmci_host_do_send_datagram () at drivers/misc/vmw_vmci/vmci_host.c:404

Here?s the relevant code snippet from dg_dispatch_as_host():
171:  dg_size = VMCI_DG_SIZE(dg);
...
235:  dg_info = kmalloc(sizeof(*dg_info) +
236:              (size_t) dg->payload_size, GFP_ATOMIC);
237:  if (!dg_info) {
238:          atomic_dec(&delayed_dg_host_queue_size);
239:          vmci_resource_put(resource);
240:          return VMCI_ERROR_NO_MEM;
241:  }
...
245:  memcpy(&dg_info->msg, dg, dg_size);

The memcpy() at line 245 copies ?dg_size? bytes from the ?dg? buffer, which is
user-supplied input retrieved via copy_from_user() at
drivers/misc/vmw_vmci/vmci_host.c:390. The ?dg_size? variable is itself derived
from the user-supplied value 'dg->payload_size.'

The only attempt to sanitize ?dg->payload_size' is in
vmci_datagram_dispatch():
331:  if (VMCI_DG_SIZE(dg) > VMCI_MAX_DG_SIZE) {
332:    pr_devel("Payload (size=%llu bytes) too big to send\n",
333:             (unsigned long long)dg->payload_size);
334:    return VMCI_ERROR_INVALID_ARGS;
335:  }

This provides an upper bound of 69,632 bytes, but it doesn?t relate the payload
size to the actual size of the user-supplied datagram. I think there should be a
comparison with 'send_info.len? in vmci_host_do_send_datagram().

Please let me know if you have any questions or need more details.

Thanks,
-David

Hi David,
> This provides an upper bound of 69,632 bytes, but it doesn?t relate the
payload size to
> the actual size of the user-supplied datagram. I think there should be a
comparison
> with 'send_info.len? in vmci_host_do_send_datagram().
Thanks so much for finding this and bringing it to our attention! I've just
sent out
a patch in a separate email (cc'd you) that hopefully addresses this. If you
find any
others, we would of course be happy to fix them. We do appreciate extra eyes.

Kind regards,
- Andy