Re: [PATCH v2] evm: fix TOCTOU heap OOB in protected xattr reads

[Roberto Sassu]

On 11/9/2026 9:05 PM, Jérémy Jean wrote:
> On 2026-11-09 10:07, Roberto Sassu wrote:
> > On 11/8/2026 12:05 AM, Jérémy Jean wrote:
> > > ima_eventinodexattrs_init_common() queries the total size of protected
> > > xattrs, allocates that amount, and calls evm_read_protected_xattrs()
> > > again to fill the buffer. This creates a TOCTOU window: if the
> > > protected xattr changes between the two calls to
> > > evm_read_protected_xattrs(), names and lengths are written without
> > > checking whether the data still fits in the target buffer. This can
> > > yield an OOB heap write that KASAN reports as:
> > >
> > >    BUG: KASAN: slab-out-of-bounds in 
> > > evm_read_protected_xattrs+0x15e/0x280
> > >    Write of size 20 at addr ffff888002c59bcd by task init/62
> > >
> > > Reject fields that no longer fit in the target buffer. For xattr
> > > values, also check the length returned by the copy before accounting it.
> > > This also handles the case where a size of 0 is treated as a length
> > > query.
> > >
> > > Fixes: 8314b6732ae4e ("ima: Define new template fields xattrnames, 
> > > xattrlengths and xattrvalues")
> > > Cc: stable@xxxxxxxxxxxxxxx
> > > Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
> > > ---
> > > Changes since v1 (after review from Sashiko):
> > > - Handle the 0 case.
> >
> > Hi Jeremy
> >
> > I already sent a patch to the mailing list to fix the same problem (it 
> > is similar to yours):
> >
> > https://lore.kernel.org/linux-integrity/20261029142707.2602008-1- 
> > roberto.sassu@xxxxxxxxxxxxxxx/
> >
> > Thanks
> >
> > Roberto
>
> Hello Roberto,
>
> Argh, I missed it when I prepared my fix, and even wasted time preparing 
> a v2.
> Thanks for the pointer though, good that this will get fixed.

No problem, thanks anyway!

Roberto

> Regards,
> Jérémy