Skip to content

security: Lack of userspace pointer validation in syscalls #191

Description

@ksaweryr

Syscalls that deal with pointers provided from the userspace do not validate whether the pointers actually point to the calling process' memory. In particular, sys_read can be used maliciously to write an arbitrary amount of bytes to an arbitrary address (including overwriting kernel function code), while sys_write can be used to read an arbitrary amount of bytes from an arbitrary address; other syscalls are less flexible but still offer the option to read/write to arbitrary addresses (e.g. sys_time, and possibly others).

This issue could be fixed by creating a function that checks if a given pointer belongs to the given process' memory map and using it to validate pointers provided by the syscall caller any time a read/write is performed.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions