misc/wasm, cmd/link: do not let command line args overwrite global data

On Wasm, wasm_exec.js puts command line arguments at the beginning
of the linear memory (following the "zero page"). Currently there
is no limit for this, and a very long command line can overwrite
the program's data section. Prevent this by limiting the command
line to 4096 bytes, and in the linker ensuring the data section
starts at a high enough address (8192).

(Arguably our address assignment on Wasm is a bit confusing. This
is the minimum fix I can come up with.)

Thanks to Ben Lubar for reporting this issue.

Fixes #48797
Fixes CVE-2021-38297

Change-Id: I0f50fbb2a5b6d0d047e3c134a88988d9133e4ab3
Reviewed-on: https://team-review.git.corp.google.com/c/golang/go-private/+/1205933
Reviewed-by: Roland Shoemaker <bracewell@google.com>
Reviewed-by: Than McIntosh <thanm@google.com>
Reviewed-on: https://go-review.googlesource.com/c/go/+/354571
Reviewed-by: Cherry Mui <cherryyz@google.com>
Reviewed-by: Heschi Kreinick <heschi@google.com>
Trust: Michael Knyszek <mknyszek@google.com>
Run-TryBot: Michael Knyszek <mknyszek@google.com>
TryBot-Result: Go Bot <gobot@golang.org>

diff --git a/misc/wasm/wasm_exec.js b/misc/wasm/wasm_exec.js
index 22b19fbe8095396d848e6f500b44c1bffee5b93e..e2f3cda995b55ac7586fdd0f67ab719a904d27fc 100644 (file)
--- a/misc/wasm/wasm_exec.js
+++ b/misc/wasm/wasm_exec.js
@@ -568,6 +568,13 @@
                                offset += 8;
                        });
 
+                       // The linker guarantees global data starts from at least wasmMinDataAddr.
+                       // Keep in sync with cmd/link/internal/ld/data.go:wasmMinDataAddr.
+                       const wasmMinDataAddr = 4096 + 4096;
+                       if (offset >= wasmMinDataAddr) {
+                               throw new Error("command line too long");
+                       }
+
                        this._inst.exports.run(argc, argv);
                        if (this.exited) {
                                this._resolveExitPromise();

diff --git a/src/cmd/link/internal/ld/data.go b/src/cmd/link/internal/ld/data.go
index 4f0ce23ce7ae650481830476693c5b4627956b8e..45e0e08793f7b73fd8af2db1fa434d238471f410 100644 (file)
--- a/src/cmd/link/internal/ld/data.go
+++ b/src/cmd/link/internal/ld/data.go
@@ -2442,6 +2442,11 @@ func splitTextSections(ctxt *Link) bool {
        return (ctxt.IsPPC64() || (ctxt.IsARM64() && ctxt.IsDarwin())) && ctxt.IsExternal()
 }
 
+// On Wasm, we reserve 4096 bytes for zero page, then 4096 bytes for wasm_exec.js
+// to store command line args. Data sections starts from at least address 8192.
+// Keep in sync with wasm_exec.js.
+const wasmMinDataAddr = 4096 + 4096
+
 // address assigns virtual addresses to all segments and sections and
 // returns all segments in file order.
 func (ctxt *Link) address() []*sym.Segment {
@@ -2451,10 +2456,14 @@ func (ctxt *Link) address() []*sym.Segment {
        order = append(order, &Segtext)
        Segtext.Rwx = 05
        Segtext.Vaddr = va
-       for _, s := range Segtext.Sections {
+       for i, s := range Segtext.Sections {
                va = uint64(Rnd(int64(va), int64(s.Align)))
                s.Vaddr = va
                va += s.Length
+
+               if ctxt.IsWasm() && i == 0 && va < wasmMinDataAddr {
+                       va = wasmMinDataAddr
+               }
        }
 
        Segtext.Length = va - uint64(*FlagTextAddr)