Bug 258914 - g_label_ntfs_taste() doesn't validate data read from disk, can generate wild pointers
Summary: g_label_ntfs_taste() doesn't validate data read from disk, can generate wild ...
Status: Closed FIXED
Alias: None
Product: Base System
Classification: Unclassified
Component: kern (show other bugs)
Version: CURRENT
Hardware: Any Any
: --- Affects Some People
Assignee: Mark Johnston
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2021-10-04 09:58 UTC by Robert Morris
Modified: 2021-10-18 13:10 UTC (History)
2 users (show)

See Also:


Attachments
Disk or USB memory stick image that causes an infinite loop in the kernel. (121.55 KB, application/x-gzip)
2021-10-04 09:58 UTC, Robert Morris
no flags Details

Note You need to log in before you can comment on or make changes to this bug.
Description Robert Morris 2021-10-04 09:58:41 UTC
Created attachment 228428 [details]
Disk or USB memory stick image that causes an infinite loop in the kernel.

g_label_ntfs_taste() in sys/geom/label/g_label_ntfs.c reads
from newly inserted disks (e.g. USB memory sticks that may
be corrupt or malicious) and uses the data without validation
to form pointers, which it dereferences.

    filerecp = g_read_data(cp, voloff, recsize, NULL);
    fr = (struct ntfs_filerec *)filerecp;
    for (ap = filerecp + fr->fr_attroff;
        atr = (struct ntfs_attr *)ap, atr->a_type != -1;
        ap += atr->reclen) {

Whoever created the disk image controls atr->reclen, and
thus can control the value of pointer atr. I've attached a
disk image whose atr->reclen is zero, and which will generate
an infinite loop in the kernel. Other values of atr->reclen
cause kernel page faults.
Comment 1 commit-hook freebsd_committer 2021-10-04 22:18:36 UTC
A commit in branch main references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=f0a08fa9f532a58f5d7a4814d6eb7ddd49f368da

commit f0a08fa9f532a58f5d7a4814d6eb7ddd49f368da
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2021-10-04 21:48:44 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2021-10-04 22:15:06 +0000

    geom_label: Add more validation for NTFS volume tasting

    - Ensure that the computed MFT record size isn't negative or larger than
      maxphys before trying to read $Volume.
    - Guard against truncated records in volume metadata.
    - Ensure that the record length is large enough to contain the volume
      name.
    - Verify that the (UTF-16-encoded) volume name's length is a multiple of
      two.

    PR:             258833, 258914
    MFC after:      2 weeks
    Sponsored by:   The FreeBSD Foundation

 sys/geom/label/g_label_ntfs.c | 37 ++++++++++++++++++++++++-------------
 1 file changed, 24 insertions(+), 13 deletions(-)
Comment 2 commit-hook freebsd_committer 2021-10-18 13:09:29 UTC
A commit in branch stable/12 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=116a988f99cd9fcac1a34c17ec0aa81be70d5e4f

commit 116a988f99cd9fcac1a34c17ec0aa81be70d5e4f
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2021-10-04 21:48:44 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2021-10-18 13:08:32 +0000

    geom_label: Add more validation for NTFS volume tasting

    - Ensure that the computed MFT record size isn't negative or larger than
      maxphys before trying to read $Volume.
    - Guard against truncated records in volume metadata.
    - Ensure that the record length is large enough to contain the volume
      name.
    - Verify that the (UTF-16-encoded) volume name's length is a multiple of
      two.

    PR:             258833, 258914
    Sponsored by:   The FreeBSD Foundation

    (cherry picked from commit f0a08fa9f532a58f5d7a4814d6eb7ddd49f368da)

 sys/geom/label/g_label_ntfs.c | 37 ++++++++++++++++++++++++-------------
 1 file changed, 24 insertions(+), 13 deletions(-)
Comment 3 commit-hook freebsd_committer 2021-10-18 13:09:31 UTC
A commit in branch stable/13 references this bug:

URL: https://cgit.FreeBSD.org/src/commit/?id=41dbff735184337b910b36a4ce963b36233916e4

commit 41dbff735184337b910b36a4ce963b36233916e4
Author:     Mark Johnston <markj@FreeBSD.org>
AuthorDate: 2021-10-04 21:48:44 +0000
Commit:     Mark Johnston <markj@FreeBSD.org>
CommitDate: 2021-10-18 13:07:58 +0000

    geom_label: Add more validation for NTFS volume tasting

    - Ensure that the computed MFT record size isn't negative or larger than
      maxphys before trying to read $Volume.
    - Guard against truncated records in volume metadata.
    - Ensure that the record length is large enough to contain the volume
      name.
    - Verify that the (UTF-16-encoded) volume name's length is a multiple of
      two.

    PR:             258833, 258914
    Sponsored by:   The FreeBSD Foundation

    (cherry picked from commit f0a08fa9f532a58f5d7a4814d6eb7ddd49f368da)

 sys/geom/label/g_label_ntfs.c | 37 ++++++++++++++++++++++++-------------
 1 file changed, 24 insertions(+), 13 deletions(-)
Comment 4 Mark Johnston freebsd_committer 2021-10-18 13:10:08 UTC
Thanks for the report.