Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] - System calls aren't sanitized #28

Open
4 tasks done
bSchnepp opened this issue Dec 7, 2021 · 1 comment
Open
4 tasks done

[BUG] - System calls aren't sanitized #28

bSchnepp opened this issue Dec 7, 2021 · 1 comment
Assignees
Labels
bug Something isn't working good first issue Good for newcomers

Comments

@bSchnepp
Copy link
Owner

bSchnepp commented Dec 7, 2021

Issue Checklist

  • A related or similar issue is not already marked as open
  • The steps to reproduce have been tested, and do produce the issue described
  • If relevant, graphical issues have a screenshot presented as well. Text-only issues have the text and it's correct version listed within a Markdown code block section
  • The most recent commit on the master branch the bug is present in, with it's commit hash, is listed in this report

=====================================================
Bug Description
A userland process issuing a system call (ie, svcCreateNamedEvent) can pass in arbitrary values to the kernel.
These do not necessarily have to be valid arguments: they could be invalid memory, memory owned by another process, etc.

To Reproduce
Please list the steps to produce the bug below:

  1. Modify a system call such as svcCreateNamedEvent in existing code (ie, sysm) to be invalid
  2. Undesired behavior is now triggered

Screenshots
If relevant, please provide screenshots here.

Expected behavior
The kernel returns an error, or refuses to complete the request

Additional information
This is a very serious bug. Any (and all) system calls need to be checked through some method of copyin/copyout from userland to a temporary kernel buffer to check if it's valid or not. Otherwise, issues like this could occur.

@bSchnepp bSchnepp added bug Something isn't working good first issue Good for newcomers labels Dec 7, 2021
@bSchnepp bSchnepp self-assigned this Dec 7, 2021
@bSchnepp
Copy link
Owner Author

Is this still valid for all system calls? Should review this later: everything should be OK now, but there might be some cases missing.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working good first issue Good for newcomers
Projects
None yet
Development

No branches or pull requests

1 participant