[PATCH] module: validate sh_name for SHT_NULL sections

From: Liu Chao <redacted>

elf_validity_cache_secstrings() checks that every section name offset is
inside the section name table, but skips headers of type SHT_NULL, since
ELF leaves their field values undefined.

However, the section lookup helpers do not check sh_type. This is
find_any_unique_sec(), which load_module() uses to locate ".modinfo":

	for (i = 1; i < info->hdr->e_shnum; i++) {
		if (strcmp(info->secstrings + info->sechdrs[i].sh_name,
			   name) == 0) {

find_any_sec() and module_enforce_rwx_sections() read sh_name the same
way, the latter from index 0. find_sec() is only shielded by its
SHF_ALLOC test, which a crafted module can satisfy.

ELF also permits SHT_NULL entries above index 0. A module that carries
one with a large sh_name passes validation and then reads out of bounds:

  BUG: unable to handle page fault for address: ffffc9004052f988
  Oops: 0000 [#1] SMP KASAN PTI
  CPU: 0 UID: 0 PID: 261 Comm: insmod Not tainted 6.18.0-rc7 #2
  RIP: 0010:strcmp+0xc/0x40
  Call Trace:
   ? find_any_unique_sec+0x89/0xf0
   load_module+0x516/0x3d30
   init_module_from_file+0xf5/0x180
   __x64_sys_finit_module+0x91/0x100

The read happens in elf_validity_cache_copy(), before the blacklist check
in early_mod_check().

Bounds check sh_name for every section header. The name table is already
known to be non-empty, so the sh_name of 0 that ELF requires at index 0
still passes, and a name offset that points outside the name table is
malformed regardless of section type. Neither an Ubuntu 20.04 x86_64
build (GCC 9.4, 6025 modules) nor an aarch64 vendor build (GCC 13.2, 127
modules) has a header with an out-of-bounds sh_name, or any SHT_NULL
header above index 0.

Link: https://lore.kernel.org/linux-modules/20260708013301.C4D4A1F000E9@smtp.kernel.org/
Cc: stable@vger.kernel.org
Signed-off-by: Liu Chao <redacted>
---
The same report lists two more SHT_NULL gaps, both from
elf_validity_cache_sechdrs skipping offset and size validation:
move_module will memcpy such a section, and elf_validity_cache_index_mod
rejects SHT_NOBITS but not SHT_NULL. Sending this one on its own first,
happy to respin all three as a series if you would rather have them
together.

The Oops line says KASAN, but the access faults rather than producing a
KASAN report, because lib/string.o is built with KASAN_SANITIZE disabled.

No Fixes tag. 3c5700aeabd8 ("module: Factor out
elf_validity_cache_secstrings") is where the exemption was added, but the
problem predates it: before that commit sh_name was only checked for
SHF_ALLOC sections and the ".modinfo" strcmp() ran ahead of the check, so
find_any_sec() could already walk off the end. Same conclusion as
9a5ff4568932 ("module: validate string table section types"), which went
in with Cc: stable and no Fixes tag. checkpatch complains about that
combination.

The scan behind that last paragraph applies exactly the predicate this
patch introduces, sh_name >= strhdr->sh_size, to every section header
from index 0. On the x86_64 host it covered 17546 modules across three
kernel trees (5.15.0-181, 5.15.0-190, 5.4.0-182), all built by GCC 9.4.0;
those trees are the same toolchain recompiling much the same driver set,
so the changelog quotes one tree rather than the total. The aarch64 side
is a 5.10 vendor kernel built with Arm GNU Toolchain 13.2. Both are GNU
toolchains - no clang-built module set was available to me.

Reproducer, needs root and an unsigned module on a kernel without
CONFIG_MODULE_SIG_FORCE. Build any minimal module, then append a
SHT_NULL section header with an out-of-bounds sh_name:

  python3 - <<'EOF'
  import struct
  SHDR = 0x40
  data = bytearray(open('dummy.ko', 'rb').read())
  shoff = struct.unpack_from('<Q', data, 0x28)[0]
  shnum = struct.unpack_from('<H', data, 0x3c)[0]
  old = bytes(data[shoff:shoff + shnum * SHDR])
  evil = bytearray(SHDR)
  struct.pack_into('<I', evil, 0, 0x40000000)
  data += b'\0' * ((8 - len(data) % 8) % 8)
  new_shoff = len(data)
  data += old + bytes(evil)
  struct.pack_into('<Q', data, 0x28, new_shoff)
  struct.pack_into('<H', data, 0x3c, shnum + 1)
  open('evil.ko', 'wb').write(data)
  EOF

  insmod evil.ko

 kernel/module/main.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/kernel/module/main.c b/kernel/module/main.c
index d0e1e0bd2ad0..7d5943cd6543 100644
--- a/kernel/module/main.c
+++ b/kernel/module/main.c

@@ -2060,9 +2060,6 @@ static int elf_validity_cache_secstrings(struct load_info *info)
 
 	for (i = 0; i < info->hdr->e_shnum; i++) {
 		shdr = &info->sechdrs[i];
-		/* SHT_NULL means sh_name has an undefined value */
-		if (shdr->sh_type == SHT_NULL)
-			continue;
 		if (shdr->sh_name >= strhdr->sh_size) {
 			pr_err("Invalid ELF section name in module (section %u type %u)\n",
 			       i, shdr->sh_type);

Thank you for your contribution! Sashiko AI review found 3 potential issue(s) to consider:

New issues:
- [Medium] The patch strictly enforces sh_name boundaries on SHT_NULL sections, violating the ELF specification and risking module load failures for valid files.

Pre-existing issues:
- [Critical] The patch leaves unvalidated sh_offset and sh_size fields of SHT_NULL and SHT_NOBITS sections vulnerable, allowing out-of-bounds reads and memory corruption.
- [High] Consumers like find_any_sec, find_any_unique_sec, and module_enforce_rwx_sections still process SHT_NULL sections, which can cause false positives and crashes if undefined fields contain in-bounds garbage.
--

commit 15965760da3d985f09b447439735945868c9d133
Author: Liu Chao [off-list ref]
Subject: module: validate sh_name for SHT_NULL sections

This commit removes the bypass for SHT_NULL sections when checking
section name boundaries. It attempts to prevent out-of-bounds reads
during section name lookups by enforcing that all sections have valid
sh_name offsets.

Link: https://lore.kernel.org/linux-modules/20260708013301.C4D4A1F000E9@smtp.kernel.org/

[Severity: Medium]
Does enforcing this boundary on SHT_NULL sections violate the ELF
specification?

According to the ELF specification, members of SHT_NULL sections, other
than the sh_type field itself, have undefined values. By removing this
check, we now strictly enforce sh_name is less than strhdr->sh_size for all
sections.

Could this cause a valid ELF module to be incorrectly rejected with
ENOEXEC if it happens to have an undefined but non-zero sh_name left over
from a post-processing tool shrinking the string table?

[Severity: High]
This is a pre-existing issue, but does removing this bypass leave
other SHT_NULL regressions unpatched?

For example, consumers like find_any_sec() and find_any_unique_sec()
do not check if sh_type is SHT_NULL before doing string comparisons:

find_any_unique_sec()
    ...
    if (strcmp(info->secstrings + info->sechdrs[i].sh_name, name) == 0) {

If an attacker crafts an SHT_NULL section with an in-bounds sh_name
that matches a targeted section name like .modinfo, will the loader
erroneously use this empty section and its undefined sh_offset and
sh_size fields?

[Severity: Critical]
This is also a pre-existing issue, but there appears to be a separate path
where unvalidated fields in SHT_NULL sections can lead to memory
corruption.

In elf_validity_cache_sechdrs(), offset and size bounds checking is
explicitly bypassed for SHT_NULL sections:

elf_validity_cache_sechdrs()
    case SHT_NULL:
    case SHT_NOBITS:
        continue;

However, move_module() does not exclude SHT_NULL sections, it only
excludes SHT_NOBITS:

move_module()
    if (shdr->sh_type != SHT_NOBITS) {
        memcpy(dest, (void *)shdr->sh_addr, shdr->sh_size);
    }

Can this sequence cause an out-of-bounds read from kernel memory if a
crafted module contains an SHT_NULL section with SHF_ALLOC set and an
arbitrary sh_offset?

Similarly, elf_validity_cache_index_mod() accepts SHT_NULL sections for
the .gnu.linkonce.this_module section.

Does this allow info->mod to point to an arbitrary kernel address when
initialized in elf_validity_cache_copy(), leading to out-of-bounds
writes during module initialization?

 		if (shdr->sh_name >= strhdr->sh_size) {
 			pr_err("Invalid ELF section name in module (section %u type %u)\n",
 			       i, shdr->sh_type);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260905110813.150411-1-liuc63@xiaopeng.com?part=1