From bf54e1710e86c7a0d2437b7153d0b866d0474f75 Mon Sep 17 00:00:00 2001 From: Elena Reshetova Date: Thu, 4 Jan 2018 02:38:15 -0800 Subject: [PATCH] userns: prevent speculative execution From: Elena Reshetova Since the pos value in function m_start() seems to be controllable by userspace and later on conditionally (upon bound check) used to resolve map->extent, insert an observable speculation barrier before its usage. This should prevent observable speculation on that branch and avoid kernel memory leak. Signed-off-by: Elena Reshetova Orabug: 27340445 CVE: CVE-2017-5753 Signed-off-by: Chuck Anderson Reviewed-by: John Haxby Signed-off-by: Kirtikar Kashyap --- kernel/user_namespace.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/user_namespace.c b/kernel/user_namespace.c index 4109f8320684..5547cfa71b51 100644 --- a/kernel/user_namespace.c +++ b/kernel/user_namespace.c @@ -495,8 +495,10 @@ static void *m_start(struct seq_file *seq, loff_t *ppos, struct uid_gid_extent *extent = NULL; loff_t pos = *ppos; - if (pos < map->nr_extents) + if (pos < map->nr_extents) { + osb(); extent = &map->extent[pos]; + } return extent; } -- 2.50.1