netdev - Re: [PATCH] ieee802154: check device type

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Sat, 23 Jul 2016 14:21:46 +0200
From:	Alexander Aring <aar@...gutronix.de>
To:	Vegard Nossum <vegard.nossum@...cle.com>
Cc:	linux-wpan@...r.kernel.org, netdev@...r.kernel.org,
	Lennert Buytenhek <buytenh@...tstofly.org>,
	Alexander Aring <alex.aring@...il.com>,
	Marcel Holtmann <marcel@...tmann.org>,
	Dmitry Eremin-Solenikov <dbaryshkov@...il.com>,
	Sergey Lapin <slapin@...fans.org>
Subject: Re: [PATCH] ieee802154: check device type

Hi,

On 07/20/2016 10:43 AM, Vegard Nossum wrote:
> I've observed a NULL pointer dereference in ieee802154_del_iface() during
> netlink fuzzing. It's the ->wpan_phy dereference here:
> 
>         phy = dev->ieee802154_ptr->wpan_phy;
> 
> My bet is that we're not checking that this is an IEEE802154 interface,
> so let's do what ieee802154_nl_get_dev() is doing. (Maybe we should even
> be calling this directly?)
> 
> Cc: Lennert Buytenhek <buytenh@...tstofly.org>
> Cc: Alexander Aring <alex.aring@...il.com>
> Cc: Marcel Holtmann <marcel@...tmann.org>
> Cc: Dmitry Eremin-Solenikov <dbaryshkov@...il.com>
> Cc: Sergey Lapin <slapin@...fans.org>
> Signed-off-by: Vegard Nossum <vegard.nossum@...cle.com>

Acked-by: Alexander Aring <aar@...gutronix.de>

thanks for letting us known that this bug exists.

Unfortunate I don't care much about this code. This code is part of the
old UAPI for 802.15.4 subsystems and there are many bugs known.

Nevertheless I added my ack here and would like that Marcel apply this
patch into his bluetooth tree repository.

The new netlink api exists since 3.19 and highly recommended to don't
use the old stuff. The ieee802154 never got out the experimental state,
there was a patch [0] which globally remove the experimental Kconfig
entry, but no maintainer ever said that this branch isn't in
experimental state anymore.

I will prepare a RFC series to remove all deprecated handling which we
have replacements for it, these are:

 - old netlink api
 - af_802154 raw sockets, will replaced by AF_PACKET RAW

- Alex

[0] https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/net/ieee802154/Kconfig?id=f4671a90c418b5aae14b61a9fc9d79c629403ca0