Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BUG: 64-bit argument comparisons do not work correctly (CVE-2019-9893) #139

Closed
pcmoore opened this Issue Feb 18, 2019 · 3 comments

Comments

Projects
None yet
1 participant
@pcmoore
Copy link
Member

pcmoore commented Feb 18, 2019

Jann Horn reported a problem with libseccomp where our approach to doing 64-bit comparisons using 32-bit operators was just plain wrong, leading to a number of potential problems with filters that used the LT, GT, LE, or GE operators.

@pcmoore pcmoore added this to the v2.4 milestone Feb 18, 2019

@pcmoore pcmoore self-assigned this Feb 18, 2019

@pcmoore pcmoore changed the title BUG: <placeholder> BUG: 64-bit argument comparisons do not work correctly Mar 14, 2019

@pcmoore

This comment has been minimized.

Copy link
Member Author

pcmoore commented Mar 14, 2019

Jann has done some searching/investigation using https://codesearch.debian.net and it would appear that only systemd and Tor appear to be using libseccomp in such a way as to trigger the bad code. In the case of systemd this appears to affect the socket address family and scheduling class filters. In the case of Tor it appears that the bad filters could impact the memory addresses passed to mprotect(2).

While I have verified the bug exists in libseccomp, I have not verified the implications to systemd, Tor, or any other applications/libraries.

@pcmoore

This comment has been minimized.

Copy link
Member Author

pcmoore commented Mar 14, 2019

This problem is fixed with commit c5bf78d, although commit cf5d153 is strongly recommended as it fixes some filter performance degradation in the fix.

From a testing perspective, commits 2878b8b, 3da42d7, b29eda9 both take the fix into account and help ensure we test for this bug in future releases.

@pcmoore pcmoore removed the pending/info label Mar 14, 2019

@pcmoore pcmoore closed this Mar 14, 2019

wr-linux-build-srv pushed a commit to WindRiver-OpenSourceLabs/meta-security that referenced this issue Mar 20, 2019

libseccomp: update to 2.4.0
Update the syscall table for Linux v5.0-rc5.
also a security releated issue;
seccomp/libseccomp#139

Signed-off-by: Armin Kuster <akuster808@gmail.com>

@pcmoore pcmoore changed the title BUG: 64-bit argument comparisons do not work correctly BUG: 64-bit argument comparisons do not work correctly (CVE-2019-9893) Mar 22, 2019

@pcmoore

This comment has been minimized.

Copy link
Member Author

pcmoore commented Mar 22, 2019

Adjusting the subject line to reference CVE-2019-9893

jpuhlman added a commit to MontaVista-OpenSourceTechnology/meta-security that referenced this issue Mar 29, 2019

libseccomp: update to 2.4.0
Source: meta-security
MR: 00000
Type: Integration
Disposition: Merged from meta-security
ChangeID: eae5224fa8e61584f91663b9d3f26868754e1f4c
Description:

Update the syscall table for Linux v5.0-rc5.
also a security releated issue;
seccomp/libseccomp#139

Signed-off-by: Armin Kuster <akuster808@gmail.com>
Signed-off-by: Jeremy Puhlman <jpuhlman@mvista.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.