File 0001-lib-handle.c-Add-missing-bounds-check-for-... of Package hivex.19595

Overview Repositories Revisions Requests Users Attributes Meta

File 0001-lib-handle.c-Add-missing-bounds-check-for-block-exce.patch of Package hivex.19595

From 61f4928dcc31b91aaf3bcbcf2898f8f09586a213 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 15 Apr 2021 15:50:13 +0100
Subject: [PATCH] lib/handle.c: Bounds check for block exceeding page length
 (CVE-2021-3504)

Hives are encoded as fixed-sized pages containing smaller variable-
length blocks:

+-------------------+-------------------+-------------------+--
  | header            |[ blk ][blk][ blk ]|[blk][blk][blk]    |
  +-------------------+-------------------+-------------------+--

Blocks should not straddle a page boundary.  However because blocks
contain a 32 bit length field it is possible to construct an invalid
hive where the last block in a page overlaps either the next page or
the end of the file:

+-------------------+-------------------+
  | header            |[ blk ][blk][ blk ..... ]
  +-------------------+-------------------+

Hivex lacked a bounds check and would process the registry.  Because
the rest of the code assumes this situation can never happen it was
possible to have a block containing some field (eg. a registry key
name) which would extend beyond the end of the file.  Hivex mmaps or
mallocs the file, causing hivex to read memory beyond the end of the
mapped region, resulting in reading other memory structures or a
crash.  (Writing beyond the end of the mapped region seems to be
impossible because we always allocate a new page before writing.)

This commit adds a check which rejects the malformed registry on
hivex_open.

Credit: Jeremy Galindo, Sr Security Engineer, Datto.com
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Fixes: CVE-2021-3504
Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1949687
---
 lib/handle.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

--- hivex-1.3.14.orig/lib/handle.c
+++ hivex-1.3.14/lib/handle.c
@@ -319,8 +319,8 @@ hivex_open (const char *filename, int fl
 #pragma GCC diagnostic pop
         if (is_root || !h->unsafe) {
           SET_ERRNO (ENOTSUP,
-                     "%s, the block at 0x%zx has invalid size %" PRIi32
-                     ", bad registry",
+                     "%s, the block at 0x%zx size %" PRIu32
+                     " <= 4 or not a multiple of 4, bad registry",
                      filename, blkoff, le32toh (block->seg_len));
           goto error;
         } else {
@@ -331,6 +331,14 @@ hivex_open (const char *filename, int fl
         }
       }
 
+      if (blkoff + seg_len > off + page_size) {
+        SET_ERRNO (ENOTSUP,
+                   "%s, the block at 0x%zx size %" PRIu32
+                   " extends beyond the current page, bad registry",
+                   filename, blkoff, le32toh (block->seg_len));
+        goto error;
+      }
+
       if (h->msglvl >= 2) {
         unsigned char *id = (unsigned char *) block->id;
         int id0 = id[0], id1 = id[1];

Places

File 0001-lib-handle.c-Add-missing-bounds-check-for-block-exce.patch of Package hivex.19595

Places