From owner-svn-src-head@FreeBSD.ORG Tue Jun 18 07:02:35 2013 Return-Path: Delivered-To: svn-src-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:1900:2254:206a::19:1]) by hub.freebsd.org (Postfix) with ESMTP id C5720D90; Tue, 18 Jun 2013 07:02:35 +0000 (UTC) (envelope-from des@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id B82AC1C6C; Tue, 18 Jun 2013 07:02:35 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r5I72ZsV034231; Tue, 18 Jun 2013 07:02:35 GMT (envelope-from des@svn.freebsd.org) Received: (from des@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id r5I72ZVc034228; Tue, 18 Jun 2013 07:02:35 GMT (envelope-from des@svn.freebsd.org) Message-Id: <201306180702.r5I72ZVc034228@svn.freebsd.org> From: Dag-Erling Smørgrav Date: Tue, 18 Jun 2013 07:02:35 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r251901 - in head: . sys/vm X-SVN-Group: head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-src-head@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the src tree for head/-current List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Tue, 18 Jun 2013 07:02:35 -0000 Author: des Date: Tue Jun 18 07:02:35 2013 New Revision: 251901 URL: http://svnweb.freebsd.org/changeset/base/251901 Log: Fix a bug that allowed a tracing process (e.g. gdb) to write to a memory-mapped file in the traced process's address space even if neither the traced process nor the tracing process had write access to that file. Security: CVE-2013-2171 Security: FreeBSD-SA-13:06.mmap Approved by: so Modified: head/UPDATING head/sys/vm/vm_map.c Modified: head/UPDATING ============================================================================== --- head/UPDATING Tue Jun 18 06:55:58 2013 (r251900) +++ head/UPDATING Tue Jun 18 07:02:35 2013 (r251901) @@ -31,6 +31,12 @@ NOTE TO PEOPLE WHO THINK THAT FreeBSD 10 disable the most expensive debugging functionality run "ln -s 'abort:false,junk:false' /etc/malloc.conf".) +20130618: + Fix a bug that allowed a tracing process (e.g. gdb) to write + to a memory-mapped file in the traced process's address space + even if neither the traced process nor the tracing process had + write access to that file. + 20130615: CVS has been removed from the base system. An exact copy of the code is available from the devel/cvs port. Modified: head/sys/vm/vm_map.c ============================================================================== --- head/sys/vm/vm_map.c Tue Jun 18 06:55:58 2013 (r251900) +++ head/sys/vm/vm_map.c Tue Jun 18 07:02:35 2013 (r251901) @@ -3807,6 +3807,12 @@ RetryLookup:; vm_map_unlock_read(map); return (KERN_PROTECTION_FAILURE); } + if ((fault_typea & VM_PROT_COPY) != 0 && + (entry->max_protection & VM_PROT_WRITE) == 0 && + (entry->eflags & MAP_ENTRY_COW) == 0) { + vm_map_unlock_read(map); + return (KERN_PROTECTION_FAILURE); + } /* * If this page is not pageable, we have to get it for all possible