HomeFreeBSD

kern_jail: missing \0 termination check on osrelease parameter

Description

kern_jail: missing \0 termination check on osrelease parameter

If a user spplies a non-\0 terminated osrelease parameter reading it back
may disclose kernel memory.
This is a problem in case of nested jails (children.max > 0, which is not
the default). Otherwise root outside the jail has access to kernel memory
by other means and root inside a jail cannot create a child jail.

Add the proper \0 check at the end of a supplied osrelease parameter and
make sure any copies of the field will be \0-terminated.

Submitted by: Hans Christian Woithe (chwoithe yahoo.com)
MFC after: 3 days

Details

Provenance
bzAuthored on
Parents
rS358991: MFC r348677 (by emaste):
Branches
Unknown
Tags
Unknown