Vulnerability: The waitid implementation in kernel/exit.c in the Linux kernel through 4.13.4 accesses rusage data structures in unintended cases, which allows local users to obtain sensitive information, and bypass the KASLR protection mechanism, via a crafted system call.
Vulnerability ID: CVE-2017-14954
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2017-10-02
File: kernel/exit.c
Commit message: fix infoleak in waitid(2)

kernel_waitid() can return a PID, an error or 0.  rusage is filled in the first
case and waitid(2) rusage should've been copied out exactly in that case, *not*
whenever kernel_waitid() has not returned an error.  Compat variant shares that
braino; none of kernel_wait4() callers do, so the below ought to fix it.

Reported-and-tested-by: Alexander Potapenko <glider@google.com>
Fixes: ce72a16fa705 ("wait4(2)/waitid(2): separate copying rusage to userland")
Cc: stable@vger.kernel.org # v4.13
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Commit author: Al Viro

Vulnerable version (before fix):
 SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, 	struct waitid_info info = {.status = 0}; 	long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL); 	int signo = 0; 	if (err > 0) { 		signo = SIGCHLD; 		err = 0; 	}  	if (!err) { 		if (ru && copy_to_user(ru, &r, sizeof(struct rusage))) 			return -EFAULT; 	} COMPAT_SYSCALL_DEFINE5(waitid, 	if (err > 0) { 		signo = SIGCHLD; 		err = 0; 	}  	if (!err && uru) { 		/* kernel_waitid() overwrites everything in ru */ 		if (COMPAT_USE_64BIT_TIME) 			err = copy_to_user(uru, &ru, sizeof(ru)); 		else 			err = put_compat_rusage(&ru, uru); 		if (err) 			return -EFAULT; 	}  	if (!infop)

Fixed version (after fix):
 SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *, 	struct waitid_info info = {.status = 0}; 	long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL); 	int signo = 0;  	if (err > 0) { 		signo = SIGCHLD; 		err = 0; 		if (ru && copy_to_user(ru, &r, sizeof(struct rusage))) 			return -EFAULT; 	} COMPAT_SYSCALL_DEFINE5(waitid, 	if (err > 0) { 		signo = SIGCHLD; 		err = 0; 		if (uru) { 			/* kernel_waitid() overwrites everything in ru */ 			if (COMPAT_USE_64BIT_TIME) 				err = copy_to_user(uru, &ru, sizeof(ru)); 			else 				err = put_compat_rusage(&ru, uru); 			if (err) 				return -EFAULT; 		} 	}  	if (!infop)

Patch:
patch: @@ -1600,12 +1600,10 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
 	struct waitid_info info = {.status = 0};
 	long err = kernel_waitid(which, upid, &info, options, ru ? &r : NULL);
 	int signo = 0;
+
 	if (err > 0) {
 		signo = SIGCHLD;
 		err = 0;
-	}
-
-	if (!err) {
 		if (ru && copy_to_user(ru, &r, sizeof(struct rusage)))
 			return -EFAULT;
 	}
@@ -1723,16 +1721,15 @@ COMPAT_SYSCALL_DEFINE5(waitid,
 	if (err > 0) {
 		signo = SIGCHLD;
 		err = 0;
-	}
-
-	if (!err && uru) {
-		/* kernel_waitid() overwrites everything in ru */
-		if (COMPAT_USE_64BIT_TIME)
-			err = copy_to_user(uru, &ru, sizeof(ru));
-		else
-			err = put_compat_rusage(&ru, uru);
-		if (err)
-			return -EFAULT;
+		if (uru) {
+			/* kernel_waitid() overwrites everything in ru */
+			if (COMPAT_USE_64BIT_TIME)
+				err = copy_to_user(uru, &ru, sizeof(ru));
+			else
+				err = put_compat_rusage(&ru, uru);
+			if (err)
+				return -EFAULT;
+		}
 	}
 
 	if (!infop)
path: kernel/exit.c