3 ms·
the syscall function takes a void* parameter then does a copy from user space into the kernel using the wrong target type/sizeof. i think it works because the i
by benmmurphy 9y ago
the syscall function takes a void* parameter then does a copy from user space into the kernel using the wrong target type/sizeof. i think it works because the incorrect type was a superset of the correct type. i don't think any static analyser could catch this.
proposed patch here:
https://bugzilla.kernel.org/attachment.cgi?id=256997&action=diff https://bugzilla.kernel.org/attachment.cgi?id=256997&action=...
- jjnoakes 9y agoA static analyzer with sufficient inter-procedural analysis (i.e. across the user/kernel boundary) could certainly see the type of the allocated structure in userspace, and flag the kernel read of a larger type.