linux-hardening - Re: [PATCH] qnx4: fix to avoid panic due to buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CALk6UxoRHWsJYuTcqg7zvf5rxGwMQymMpjGuSEw3d+syAVyt=g@mail.gmail.com>
Date: Mon, 13 Nov 2023 19:25:01 +1000
From: Ronald Monthero <debug.penguin32@...il.com>
To: Anders Larsen <al@...rsen.net>
Cc: keescook@...omium.org, gustavoars@...nel.org, linux-kernel@...r.kernel.org, 
	linux-hardening@...r.kernel.org, Niek Nooijens <nieknooijens@...il.com>
Subject: Re: [PATCH] qnx4: fix to avoid panic due to buffer overflow

On Mon, Nov 13, 2023 at 2:16 AM Anders Larsen <al@...rsen.net> wrote:
>
> On 2023-11-12 10:53 Ronald Monthero wrote:
> > qnx4 dir name length can vary to be of maximum size
> > QNX4_NAME_MAX or QNX4_SHORT_NAME_MAX depending on whether
> > 'link info' entry is stored and the status byte is set.
> > So to avoid buffer overflow check di_fname length
> > fetched from (struct qnx4_inode_entry *)
> > before use in strlen to avoid buffer overflow.
>
> [snip]
>
> >
> > Signed-off-by: Ronald Monthero <debug.penguin32@...il.com>
> > ---
> >  fs/qnx4/namei.c | 7 +++++++
> >  1 file changed, 7 insertions(+)
> >
> > diff --git a/fs/qnx4/namei.c b/fs/qnx4/namei.c
> > index 8d72221735d7..825b891a52b3 100644
> > --- a/fs/qnx4/namei.c
> > +++ b/fs/qnx4/namei.c
> > @@ -40,6 +40,13 @@ static int qnx4_match(int len, const char *name,
> >       } else {
> >               namelen = QNX4_SHORT_NAME_MAX;
> >       }
> > +
> > +     /** qnx4 dir name length can vary, check the di_fname
> > +      * fetched from (struct qnx4_inode_entry *) before use in
> > +      * strlen to avoid panic due to buffer overflow"
> > +      */
> > +     if (strnlen(de->di_fname, namelen) >= sizeof(de->di_fname))
> > +             return -ENAMETOOLONG;
>
> sizeof(de->di_fname) equals QNX4_SHORT_NAME_MAX, so this test fails as soon as
> a filename is longer than that!

I suppose de->di_fname can be QNX4_NAME_MAX or QNX4_SHORT_NAME_MAX isn't it ?
It's set based on di_status, if di_status is set, then it will be
QNX4_NAME_MAX and otherwise QNX4_SHORT_NAME_MAX.
We capture that into namelen, prior to the  string length check  - if
(strnlen(de->di_fname, namelen) >= sizeof(de->di_fname))
as below:

        de = (struct qnx4_inode_entry *) (bh->b_data + *offset);
        *offset += QNX4_DIR_ENTRY_SIZE;
        if ((de->di_status & QNX4_FILE_LINK) != 0) {
                namelen = QNX4_NAME_MAX;
        } else {
                namelen = QNX4_SHORT_NAME_MAX;
        }

BR,
Ron


> This quick fix (untested!) should do the trick (and avoids computing the length
> of the name twice):
>
> diff --git a/fs/qnx4/namei.c b/fs/qnx4/namei.c
> index 8d72221735d7..7694f86fbb2e 100644
> --- a/fs/qnx4/namei.c
> +++ b/fs/qnx4/namei.c
> @@ -40,9 +40,7 @@ static int qnx4_match(int len, const char *name,
>         } else {
>                 namelen = QNX4_SHORT_NAME_MAX;
>         }
> -       thislen = strlen( de->di_fname );
> -       if ( thislen > namelen )
> -               thislen = namelen;
> +       thislen = strnlen(de->di_fname, namelen);
>         if (len != thislen) {
>                 return 0;
>         }
>
> Cheers
> Anders
>
>