linux/fs/ecryptfs
Tyler Hicks 8faece5f90 eCryptfs: Allocate a variable number of pages for file headers
When allocating the memory used to store the eCryptfs header contents, a
single, zeroed page was being allocated with get_zeroed_page().
However, the size of an eCryptfs header is either PAGE_CACHE_SIZE or
ECRYPTFS_MINIMUM_HEADER_EXTENT_SIZE (8192), whichever is larger, and is
stored in the file's private_data->crypt_stat->num_header_bytes_at_front
field.

ecryptfs_write_metadata_to_contents() was using
num_header_bytes_at_front to decide how many bytes should be written to
the lower filesystem for the file header.  Unfortunately, at least 8K
was being written from the page, despite the chance of the single,
zeroed page being smaller than 8K.  This resulted in random areas of
kernel memory being written between the 0x1000 and 0x1FFF bytes offsets
in the eCryptfs file headers if PAGE_SIZE was 4K.

This patch allocates a variable number of pages, calculated with
num_header_bytes_at_front, and passes the number of allocated pages
along to ecryptfs_write_metadata_to_contents().

Thanks to Florian Streibelt for reporting the data leak and working with
me to find the problem.  2.6.28 is the only kernel release with this
vulnerability.  Corresponds to CVE-2009-0787

Signed-off-by: Tyler Hicks <tyhicks@linux.vnet.ibm.com>
Acked-by: Dustin Kirkland <kirkland@canonical.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Reviewed-by: Eugene Teo <eugeneteo@kernel.sg>
Cc: Greg KH <greg@kroah.com>
Cc: dann frazier <dannf@dannf.org>
Cc: Serge E. Hallyn <serue@us.ibm.com>
Cc: Florian Streibelt <florian@f-streibelt.de>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2009-03-22 11:20:43 -07:00
..
crypto.c eCryptfs: Allocate a variable number of pages for file headers 2009-03-22 11:20:43 -07:00
debug.c eCryptfs: update comment and debug statement 2007-10-16 09:43:11 -07:00
dentry.c eCryptfs: Swap dput() and mntput() 2008-03-19 18:53:36 -07:00
ecryptfs_kernel.h eCryptfs: don't encrypt file key with filename key 2009-03-14 11:57:22 -07:00
file.c eCryptfs: Fix data types (int/size_t) 2009-01-06 15:59:22 -08:00
inode.c fs/ecryptfs/inode.c: cleanup kerneldoc 2009-01-06 15:59:22 -08:00
Kconfig fs/Kconfig: move ecryptfs out 2009-01-22 13:15:56 +03:00
keystore.c eCryptfs: don't encrypt file key with filename key 2009-03-14 11:57:22 -07:00
kthread.c CRED: Pass credentials through dentry_open() 2008-11-14 10:39:22 +11:00
main.c eCryptfs: don't encrypt file key with filename key 2009-03-14 11:57:22 -07:00
Makefile eCryptfs: remove netlink transport 2008-10-16 11:21:39 -07:00
messaging.c eCryptfs: Replace %Z with %z 2009-01-06 15:59:22 -08:00
miscdev.c eCryptfs: Replace %Z with %z 2009-01-06 15:59:22 -08:00
mmap.c fs: symlink write_begin allocation context fix 2009-01-04 13:33:20 -08:00
read_write.c eCryptfs: remove unnecessary page decrypt call 2008-06-06 11:29:09 -07:00
super.c ecryptfs: remove debug as mount option, and warn if set via modprobe 2008-02-06 10:41:12 -08:00