[bug] Userspace programs can arbitrary write into kernel memory #69

New issue

Open

opened 2024-05-23 16:43:38 +02:00 by hgruniaux · 0 comments

hgruniaux commented

2024-05-23 16:43:38 +02:00

(Migrated from github.com)

The check_ptr() function in kernel syscalls do not check the number of bytes that will be written by the kernel. It only check if the address is valid and accessible (that is only the first byte, but not the other bytes).

That is, check_ptr() should take an additional argument: the expected number of bytes that will be written by the kernel and check if the memory range is accessible.

The `check_ptr()` function in kernel syscalls do not check the number of bytes that will be written by the kernel. It only check if the address is valid and accessible (that is only the first byte, but not the other bytes). That is, `check_ptr()` should take an additional argument: the expected number of bytes that will be written by the kernel and check if the memory range is accessible.