From: Vesa-Matti J Kari Date: Tue, 22 Jul 2008 21:06:13 +0000 (+0300) Subject: kernel/audit.c control character detection is off-by-one X-Git-Tag: v2.6.27-rc2~106^2~3 X-Git-Url: http://pilppa.com/gitweb/?a=commitdiff_plain;h=1d6c9649e236caa2e93e3647256216e57172b011;p=linux-2.6-omap-h63xx.git kernel/audit.c control character detection is off-by-one Hello, According to my understanding there is an off-by-one bug in the function: audit_string_contains_control() in: kernel/audit.c Patch is included. I do not know from how many places the function is called from, but for example, SELinux Access Vector Cache tries to log untrusted filenames via call path: avc_audit() audit_log_untrustedstring() audit_log_n_untrustedstring() audit_string_contains_control() If audit_string_contains_control() detects control characters, then the string is hex-encoded. But the hex=0x7f dec=127, DEL-character, is not detected. I guess this could have at least some minor security implications, since a user can create a filename with 0x7f in it, causing logged filename to possibly look different when someone reads it on the terminal. Signed-off-by: Vesa-Matti Kari Signed-off-by: Al Viro --- diff --git a/kernel/audit.c b/kernel/audit.c index e092f1c0ce3..6d903182c6b 100644 --- a/kernel/audit.c +++ b/kernel/audit.c @@ -1366,7 +1366,7 @@ int audit_string_contains_control(const char *string, size_t len) { const unsigned char *p; for (p = string; p < (const unsigned char *)string + len && *p; p++) { - if (*p == '"' || *p < 0x21 || *p > 0x7f) + if (*p == '"' || *p < 0x21 || *p > 0x7e) return 1; } return 0;