From: Vesa-Matti J Kari <vmkari@cc.helsinki.fi>
Date: Tue, 22 Jul 2008 21:06:13 +0000 (+0300)
Subject: kernel/audit.c control character detection is off-by-one
X-Git-Tag: v2.6.27-rc2~106^2~3
X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1d6c9649e236caa2e93e3647256216e57172b011;p=linux-2.6

kernel/audit.c control character detection is off-by-one

Hello,

According to my understanding there is an off-by-one bug in the
function:

   audit_string_contains_control()

in:

  kernel/audit.c

Patch is included.

I do not know from how many places the function is called from, but for
example, SELinux Access Vector Cache tries to log untrusted filenames via
call path:

avc_audit()
     audit_log_untrustedstring()
         audit_log_n_untrustedstring()
             audit_string_contains_control()

If audit_string_contains_control() detects control characters, then the
string is hex-encoded. But the hex=0x7f dec=127, DEL-character, is not
detected.

I guess this could have at least some minor security implications, since a
user can create a filename with 0x7f in it, causing logged filename to
possibly look different when someone reads it on the terminal.

Signed-off-by: Vesa-Matti Kari <vmkari@cc.helsinki.fi>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---

diff --git a/kernel/audit.c b/kernel/audit.c
index e092f1c0ce..6d903182c6 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -1366,7 +1366,7 @@ int audit_string_contains_control(const char *string, size_t len)
 {
 	const unsigned char *p;
 	for (p = string; p < (const unsigned char *)string + len && *p; p++) {
-		if (*p == '"' || *p < 0x21 || *p > 0x7f)
+		if (*p == '"' || *p < 0x21 || *p > 0x7e)
 			return 1;
 	}
 	return 0;