sys: avoid script pathname TOCTOU in exec
A readable script pathname is read twice during exec: namei() copies the
user string for vnode lookup, while exec_script_makecmds() later copies
the same user address into the synthetic interpreter argument list. The
preceding single_thread_set() excludes sibling threads from this window;
a separate process sharing writable MAP_SHARED memory remains able to
modify the pathname between reads.
The failing sequence is:
1. Setup: a process stores pathname A in writable MAP_SHARED memory and
calls fork(); the parent and child retain mappings of the same VM
object.
2. Check: the parent calls execve(2); namei() copies pathname A and
resolves vnode A, after which check_exec() verifies execution access
and reads the script header.
3. Mutation: after namei() copies A but before the script handler
rereads the user address, the child stores pathname B through its
[15 lines not shown]
PKCS7_stream: avoid out of bounds access
The inner content of SignedData is represented by a PKCS7 object, which
PKCS7_stream() assumes to be a plain data object and will thus access its
content via an ASN1_OCTET_STRING. This need not be the case after parsing.
In fact, the inner content type is essentially arbitrary.
If the inner content isn't one of the explicitly supported content types,
the fallback (via p7default_tt) will populate the union's d.other with an
ASN1_ANY which unravels to ASN1_TYPE_new() deep in the guts of tasn_dec,
allocating a 16-byte object on LP64 architectures. In that case, the
16-byte object is interpreted as an 24-byte ASN1_OCTET_STRING and if it
isn't NULL, the read+write to os->flags (a long at offset 16) is out of
bounds: os->flags | ASN1_STRING_FLAG_NDEF;
Add a check that the content is actually id-data before accessing the
d.data union member.
From Acts1631
Add test case causing an OOB access in PKCS7_stream
Test case originally from openssl/openssl#31681, exercised via a direct
call to PKCS7_stream() as in a report from Acts1631.
To be fixed in pk7_lib.c r1.33
PKCS7_stream: don't crash on omitted content
Do not access the PKCS7 content union without checking that it's actually
populated. Add NULL checks and fail. Whether that's the correct thing
to do is dubious, but since this has been broken since the "code" was
written a quarter century ago, clearly nobody ever wanted to do that.
Match OpenSSL behavior which also means more NULL checks than strictly
make sense.
CMS_stream() has very similar code, but it's not problematic in this
particular way because the content isn't OPTIONAL.
Part of a diff from Acts1631
"Stream" valid PKCS7 objects with omitted content
The PKCS#7 standard marks the content element of the ContentInfo OPTIONAL.
Accordingly, a PKCS#7 object only containing a Content Type OID is valid:
SEQUENCE {
OBJECT_IDENTIFIER { 1.2.840.113549.1.7.4 }
}
Deserializing such an object works and therefore streaming should at least
have the decency of not segfaulting. Of course there's nothing decent about
PKCS#7 be it the standard or its OpenSSL "implementation".
Exercises a problem reported by Acts1361 and currently crashes.
To be fixed in pk7_lib.c r1.32.
mention that specific files opened by __pledge_open() are only opened
by specific libc functions (with symbol visibility helping us). these fd
are marked UF_PLEDGEOPEN, and the kernel prohibits various operations
on them (basically we are trying to prevent threads from playing with them)
In execve(2), attempt to create a realpath buffer for the executable
and place the resulting string on the stack as an auxval. The two
main reasons why the attempt can fail are if the program is started
inside an unlinked directory or if the buffer exceeds PATH_MAX. libc
will be able to find this auxval and provide it in an uncoming
getexecpath(3) API.
ok kettenis beck kirill
libssl: avoid narrowing return value in dtls1_ctrl
dtls1_ctrl() and ssl3_ctrl() return long, but the intermediate return
value was stored in an int. Use long to avoid truncating values returned
by ssl3_ctrl().
CID 497395
From Yuji Hashimoto
ok tb jsing
Make CRYPTO_cleanup_all_ex_data() a compatibility no-op
The ex_data callback registry is process-wide, but this API could free
it while other threads were still using libcrypto, resulting in a
use-after-free.
Retain the public symbol as a compatibility no-op and mark it
deprecated. Move the actual cleanup to an internal function called by
OPENSSL_cleanup(). Replace the in-tree callers with OPENSSL_cleanup()
at final shutdown to preserve cleanup behavior and coverage.
Document both APIs and the requirement that OPENSSL_cleanup() only be
called after all threads and components have stopped using libcrypto.
ok tb
Delay starting HTML output until we are sure that we have some data
to offer to the user, either from a manual page file that can actually
be opened or at least a list of links to pages matching the user's query.
When no information whatsoever can be accessed, always return
HTTP 400 Bad Request (e.g. for an unsupported, nonexistent, or unreadable
path or an invalid architecture) or HTTP 500 Internal Server Error (e.g.
for a system call failure, an inaccessible or invalid configuration file,
an inaccessible directory, or a corrupt database).
This also prepares for pledge(2)/unveil(2) improvements by making it
possible to invoke these system calls after open(2)ing the chosen
manual page file.
Clamp numeric arguments of terminal escape sequences to an arbitrary value of
100,000. The existing logic would happily process as many digits as provided,
which could make the values wraparound at 2**32, or be considered as negative
values if cast to a signed type, leading to incorrect processing.
Bug report by Acts1631.
collapse ranges of community ids when printing pvlan info.
mostly borrowed from the code that collapses ranges of vids when
printing the allowed vlan tags on ports.
