mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom
authorJinbum Park <jinb.park7@gmail.com>
Tue, 31 Jul 2018 14:10:40 +0000 (23:10 +0900)
committerJohannes Berg <johannes.berg@intel.com>
Tue, 28 Aug 2018 09:14:56 +0000 (11:14 +0200)
commit3a2af7cccbbaf2362db9053a946a6084e12bfa73
treef2d2335e8f2e74b528d4ee0648a721505b342ef6
parent20932750d9c78d307e4f2f18f9c6a32b82b1e0e8
mac80211_hwsim: Fix possible Spectre-v1 for hwsim_world_regdom_custom

User controls @idx which to be used as index of hwsim_world_regdom_custom.
So, It can be exploited via Spectre-like attack. (speculative execution)

This kind of attack leaks address of hwsim_world_regdom_custom,
It leads an attacker to bypass security mechanism such as KASLR.

So sanitize @idx before using it to prevent attack.

I leveraged strategy [1] to find and exploit this gadget.

[1] https://github.com/jinb-park/linux-exploit/tree/master/exploit-remaining-spectre-gadget/

Signed-off-by: Jinbum Park <jinb.park7@gmail.com>
[johannes: unwrap URL]
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/mac80211_hwsim.c