11.1.0-34: Difference between revisions

(2 intermediate revisions by one other user not shown)

Line 22:

* L_fff1c730, prev ver @ L_fff1c6f0.

* L_fff26410, prev ver @ L_fff26394.

All three functions now prevent negative chunk sizes to be used, which could have been used with hypotetical kernel-memory-read vulnerabilities to exploit the memory-management code.

The first function ("validateChunk") now makes sure that:

chunk + currentChunkSize >= currentChunk

when checking that the current chunk doesn't overlap with either the previous or next one.

The second function ("Kern::ControlMemory"), aside from other small changes, now makes additional checks on the previously allocated memory chunk; the code for that is now:

if(chunkSizeInPages >= regionSize >> 12 || chunk < regionBase || chunk + chunkSize < chunk || chunk + chunkSize > regionBase + regionSize) panic;

The third function ("insertChunk") now makes the following checks:

if(chunkSizeInPages >= regionSize >> 12 || regionBase + regionSize < chunk + chunkSize) panic;

// ...

if(leftChunk && leftChunk + leftChunkSize <= leftChunk) panic; // this check was already done on 'right'

====FIRM-modules====

Line 84:

Line 101:

* [https://yls8.mtheall.com/ninupdates/reports.php?date=09-13-16_12-05-19&sys=ctr]

* [https://yls8.mtheall.com/ninupdates/reports.php?date=09-13-16_12-05-28&sys=ktr]

[[Category:Firmware Versions]]

@@ Line 22: / Line 22: @@
 * L_fff1c730, prev ver @ L_fff1c6f0.
 * L_fff26410, prev ver @ L_fff26394.
+All three functions now prevent negative chunk sizes to be used, which could have been used with hypotetical kernel-memory-read vulnerabilities to exploit the memory-management code.
+The first function ("validateChunk") now makes sure that:
+ chunk + currentChunkSize >= currentChunk
+when checking that the current chunk doesn't overlap with either the previous or next one.
+The second function ("Kern::ControlMemory"), aside from other small changes, now makes additional checks on the previously allocated memory chunk; the code for that is now:
+ if(chunkSizeInPages >= regionSize >> 12 || chunk < regionBase || chunk + chunkSize < chunk || chunk + chunkSize > regionBase + regionSize) panic;
+The third function ("insertChunk") now makes the following checks:
+ if(chunkSizeInPages >= regionSize >> 12 || regionBase + regionSize < chunk + chunkSize) panic;
+ // ...
+ if(leftChunk && leftChunk + leftChunkSize <= leftChunk) panic; // this check was already done on 'right'
 ====FIRM-modules====
@@ Line 84: / Line 101: @@
 * [https://yls8.mtheall.com/ninupdates/reports.php?date=09-13-16_12-05-19&sys=ctr]
 * [https://yls8.mtheall.com/ninupdates/reports.php?date=09-13-16_12-05-28&sys=ktr]
+[[Category:Firmware Versions]]