linux-kernel - Re: net/netlink: another global-out-of-bounds in genl_family_rcv_msg/validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Fri, 4 Nov 2016 00:34:58 +0100
From:   Andrey Konovalov <andreyknvl@...gle.com>
To:     Cong Wang <xiyou.wangcong@...il.com>
Cc:     "David S. Miller" <davem@...emloft.net>,
        Nicolas Dichtel <nicolas.dichtel@...nd.com>,
        LKML <linux-kernel@...r.kernel.org>,
        Matti Vaittinen <matti.vaittinen@...ia.com>,
        Tycho Andersen <tycho.andersen@...onical.com>,
        stephen hemminger <stephen@...workplumber.org>,
        Tom Herbert <tom@...bertland.com>,
        Florian Westphal <fw@...len.de>,
        netdev <netdev@...r.kernel.org>,
        Dmitry Vyukov <dvyukov@...gle.com>,
        Alexander Potapenko <glider@...gle.com>,
        Kostya Serebryany <kcc@...gle.com>,
        Eric Dumazet <edumazet@...gle.com>,
        syzkaller <syzkaller@...glegroups.com>
Subject: Re: net/netlink: another global-out-of-bounds in genl_family_rcv_msg/validate_nla

On Fri, Nov 4, 2016 at 12:22 AM, Cong Wang <xiyou.wangcong@...il.com> wrote:
> On Thu, Nov 3, 2016 at 4:04 PM, Andrey Konovalov <andreyknvl@...gle.com> wrote:
>> Hi,
>>
>> I've got the following error report while running the syzkaller fuzzer:
>>
>> BUG: KASAN: global-out-of-bounds in validate_nla+0x49b/0x4e0 at addr
>> ffffffff84452de0
>> Read of size 2 by task syz-executor/19055
>> Address belongs to variable ip_vs_cmd_policy+0x20/0x40
>
> LOL, seems a typo
>
> diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
> index c3c809b..a6e44ef 100644
> --- a/net/netfilter/ipvs/ip_vs_ctl.c
> +++ b/net/netfilter/ipvs/ip_vs_ctl.c
> @@ -2845,7 +2845,7 @@ static struct genl_family ip_vs_genl_family = {
>         .hdrsize        = 0,
>         .name           = IPVS_GENL_NAME,
>         .version        = IPVS_GENL_VERSION,
> -       .maxattr        = IPVS_CMD_MAX,
> +       .maxattr        = IPVS_CMD_ATTR_MAX,
>         .netnsok        = true,         /* Make ipvsadm to work on netns */
>  };

This fixes the issue for me.

Tested-by: Andrey Konovalov <andreyknvl@...gle.com>

Thanks again!