CVE-2023-40548 Fix integer overflow on SBAT section size on 32-bit system

In verify_sbat_section(), we do some math on data that comes from the
binary being verified - in this case, we add 1 to the size of the
".sbat" section as reported in the section header, which is then used as
the input to the size of an allocation.  The original value is then used
for a size in a memcpy(), which means there's an out-of-bounds write in
the overflow case.

Due to the type of the variable being size_t, but the type in the
section header being uint32_t, this is only plausibly accomplished on
32-bit systems.

This patch makes the arithmetic use a checked add operation to avoid
overflow.  Additionally, it adds a check in verify_buffer_sbat() to
guarantee that the data is within the binary.

It's not currently known if this is actually exploitable on such
systems; the memory layout on a particular machine may further mitigate
this scenario.

Resolves: CVE-2023-40548
Reported-by: gkirkpatrick@google.com
Signed-off-by: Peter Jones <pjones@redhat.com>

0 files changed, 0 insertions, 0 deletions