Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use of userspace capability as kernel capability in hybrid compatibility layer for syscall getfhat #2278

Open
RoundofThree opened this issue Dec 28, 2024 · 0 comments
Open

Use of userspace capability as kernel capability in hybrid compatibility layer for syscall getfhat #2278

RoundofThree opened this issue Dec 28, 2024 · 0 comments

Comments

@RoundofThree
Copy link
Member

  • Type: User provided capability passed to functions meant for copying data between kernel memory locations, causing panic (due to PAN?)
  • Trigger Conditions: For a jail, prison_check_nfsd in the kernel has to return true, which means allow.nfsd must be set, plus a few more conditions in the comment above the function. This feels like a rare usecase. Trigger code must run in hybrid mode.
  • Impact: Local DoS on CheriBSD only.
  • Root cause:
    freebsd64_getfhat calls kern_getfhat with UIO_SYSSPACE as 5th argument. This makes kern_getfhat treat the 4th argument coming from userspace as a kernel capability.

Tagging @YiChenChai.
brooksdavis added a commit that referenced this issue Jan 3, 2025
@brooksdavis
freebsd64_getfhat: path is a userspace argument
5db6d2e 
It appears I accidently marked the path argument to kern_getfhat as
a kernel pointer in the initial implementation (bbeb37f).

Fixes: #2278
@brooksdavis brooksdavis mentioned this issue Jan 3, 2025
Merged
bsdjhb pushed a commit that referenced this issue Jan 4, 2025
@brooksdavis @bsdjhb
freebsd64_getfhat: path is a userspace argument
dcd7841 
It appears I accidently marked the path argument to kern_getfhat as
a kernel pointer in the initial implementation (bbeb37f).

Fixes: #2278
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
1 participant
@RoundofThree