github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

um: mconsole: Fix out-of-bounds read in mconsole_log()

Browse Source 
mconsole_parse() matches the 3-byte prefix "log", but mconsole_log()
skips strlen("log ") = 4 bytes, advancing ptr past the NUL terminator
when a client sends "log" without a trailing space.

The length then comes from req->len, the raw recvfrom() count, instead
of req->request.len, so printk() reads up to req->len - 4 bytes of
stale data from a previous request left in the static mc_request
buffer, leaking it to the kernel log.

Use req->cmd->command for the actual command length, add skip_spaces(),
use req->request.len, and guard against non-positive length.

Signed-off-by: Shengzhuo Wei <me@cherr.cc>
Link: https://patch.msgid.link/20260425-mconsole-oob-read-leak-v1-1-7d46e5892c5c@cherr.cc
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Shengzhuo Wei 2026-04-25 04:29:24 +08:00 committed by Johannes Berg
parent 9756ecdbff
commit af20aad1dd
1 changed files with 5 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
arch/um/drivers/mconsole_kern.c
View File

@ -117,10 +117,12 @@ void mconsole_log(struct mc_request *req)
int len;
char *ptr = req->request.data;
ptr += strlen("log ");
ptr += strlen(req->cmd->command);
ptr = skip_spaces(ptr);
len = req->len - (ptr - req->request.data);
printk(KERN_WARNING "%.*s", len, ptr);
len = req->request.len - (ptr - req->request.data);
if (len > 0)
printk(KERN_WARNING "%.*s", len, ptr);
mconsole_reply(req, "", 0, 0);
}