(no subject)

In fs/binfmt_elf.c, line 1193, e_entry value can be overflowed. This
potentially allows to create a fake entry point field for an ELF file.

The local variable e_entry is set to elf_ex->e_entry + load_bias.
Given an ET_DYN ELF file, without a PT_INTERP program header, with an 
elf_ex->e_entry field in the ELF header, which equals to
0xffffffffffffffff(in x86_64 for example), and a load_bias which is greater 
than 0, e_entry(the local variable) overflows. This bypasses the check of 
BAD_ADDR macro in line 1241.

It is possible to set a large enough NO-OP(NOP) sled, before the
actual code, modify the elf_ex->e_entry field so that elf_ex->e_entry+load_bias
will be in the range where the NO-OP sled is mapped(because the offset
of the PT_LOAD program header of the text segment can be controlled). 
This is practically a guess, because load_bias is randomized, the ELF file can
be loaded a large amount of times until elf_ex->e_entry + load_bias 
is in the range of the NO-OP sled.
To conclude, this bug potentially allows the creation of a "fake" entry point
field in the ELF file header. 

Suggested git diff:

Add a BAD_ADDR test to elf_ex->e_entry to prevent from using an
overflowed elf_entry value.

Signed-off-by: Itay Iellin <redacted>
---
 fs/binfmt_elf.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index 439ed81e755a..b59dcd5857db 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c

@@ -1238,7 +1238,7 @@ static int load_elf_binary(struct linux_binprm *bprm)
 		kfree(interp_elf_phdata);
 	} else {
 		elf_entry = e_entry;
-		if (BAD_ADDR(elf_entry)) {
+		if (BAD_ADDR(elf_entry) || BAD_ADDR(elf_ex->e_entry)) {
 			retval = -EINVAL;
 			goto out_free_dentry;
 		}

-- 
2.32.0