aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorGordon Tetlow <gordon@FreeBSD.org>2020-03-19 16:49:32 +0000
committerGordon Tetlow <gordon@FreeBSD.org>2020-03-19 16:49:32 +0000
commit9842ed8859172c3553bc3d833fec8bca73256ea6 (patch)
tree3e6ced9774a4d7ce69d1c87c39f315eb1fce7ecd
parent03a5d3e78cda9e430d4b921475056a6f17a69c5a (diff)
downloadsrc-9842ed8859172c3553bc3d833fec8bca73256ea6.tar.gz
src-9842ed8859172c3553bc3d833fec8bca73256ea6.zip
Fix insufficient ixl(4) ioctl(2) privilege checking.
Approved by: so Security: FreeBSD-SA-20:06.if_ixl_ioctl Security: CVE-2019-15877
Notes
Notes: svn path=/releng/12.1/; revision=359140
-rw-r--r--sys/dev/ixl/if_ixl.c28
-rw-r--r--sys/dev/ixl/ixl.h1
2 files changed, 24 insertions, 5 deletions
diff --git a/sys/dev/ixl/if_ixl.c b/sys/dev/ixl/if_ixl.c
index ed1513f3a514..d3e3f5e2b643 100644
--- a/sys/dev/ixl/if_ixl.c
+++ b/sys/dev/ixl/if_ixl.c
@@ -1625,11 +1625,29 @@ ixl_if_priv_ioctl(if_ctx_t ctx, u_long command, caddr_t data)
struct ifdrv *ifd = (struct ifdrv *)data;
int error = 0;
- /* NVM update command */
- if (ifd->ifd_cmd == I40E_NVM_ACCESS)
- error = ixl_handle_nvmupd_cmd(pf, ifd);
- else
- error = EINVAL;
+ /*
+ * The iflib_if_ioctl forwards SIOCxDRVSPEC and SIOGPRIVATE_0 without
+ * performing privilege checks. It is important that this function
+ * perform the necessary checks for commands which should only be
+ * executed by privileged threads.
+ */
+
+ switch(command) {
+ case SIOCGDRVSPEC:
+ case SIOCSDRVSPEC:
+ /* NVM update command */
+ if (ifd->ifd_cmd == I40E_NVM_ACCESS) {
+ error = priv_check(curthread, PRIV_DRIVER);
+ if (error)
+ break;
+ error = ixl_handle_nvmupd_cmd(pf, ifd);
+ } else {
+ error = EINVAL;
+ }
+ break;
+ default:
+ error = EOPNOTSUPP;
+ }
return (error);
}
diff --git a/sys/dev/ixl/ixl.h b/sys/dev/ixl/ixl.h
index d38f391cf928..41d682dadfea 100644
--- a/sys/dev/ixl/ixl.h
+++ b/sys/dev/ixl/ixl.h
@@ -52,6 +52,7 @@
#include <sys/sockio.h>
#include <sys/eventhandler.h>
#include <sys/syslog.h>
+#include <sys/priv.h>
#include <net/if.h>
#include <net/if_var.h>