kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

mon_procd: Fix possible static buffer overflow

Browse Source 
The command line length value is not properly checked and limited to the
documented 1024 bytes, even though a MAX_CMD_LEN is already defined but
not used.

With this, an overflow of the static char mon_record[] buffer is possible
in read_cmdline(), corrupting adjacent .bss data. The data is sanitized to
printable ASCII bytes, but in theory a crash of the mon_procd daemon could
be possible.

Fix it by adding a check and truncation similar to the other restricted
fields like e.g. ruser_len or cmd_len.

Reviewed-by: Ilya Leoshkevich <iii@linux.ibm.com>
Signed-off-by: Gerald Schaefer <gerald.schaefer@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Gerald Schaefer
2026-07-09 16:24:39 +02:00
committed by Jan Höppner
parent 3cf95a1d92
commit 42eba67268
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
mon_tools/mon_procd.c
View File

@@ -742,6 +742,8 @@ static int read_cmdline(struct task_t *task)
buf[i] = ' ';
}
name_lens.cmdline_len = num;
if (name_lens.cmdline_len > MAX_CMD_LEN)
name_lens.cmdline_len = MAX_CMD_LEN;
cmdlnlenp = mon_record + sizeof(struct monwrite_hdr);
cmdlnlenp += sizeof(struct procd_hdr);
cmdlnlenp += sizeof(struct task_t);