linux-kernel - Re: [PATCH 1/3] netfilter: Fix copy_to

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20120301113736.GE22598@mwanda>
Date:	Thu, 1 Mar 2012 14:37:36 +0300
From:	Dan Carpenter <dan.carpenter@...cle.com>
To:	Pablo Neira Ayuso <pablo@...filter.org>
Cc:	santosh nayak <santoshprasadnayak@...il.com>,
	bart.de.schuymer@...dora.be, kaber@...sh.net,
	shemminger@...tta.com, davem@...emloft.net,
	netfilter-devel@...r.kernel.org, netfilter@...r.kernel.org,
	coreteam@...filter.org, bridge@...ts.linux-foundation.org,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	kernel-janitors@...r.kernel.org
Subject: Re: [PATCH 1/3] netfilter: Fix copy_to_user too small size parametre.

On Thu, Mar 01, 2012 at 11:18:09AM +0100, Pablo Neira Ayuso wrote:
> On Thu, Mar 01, 2012 at 02:46:30PM +0530, santosh nayak wrote:
> > From: Santosh Nayak <santoshprasadnayak@...il.com>
> > 
> > While copying to userspace, the size of source is 29byte where as
> > size parametre is 32 byte.  Its leaking extra-information from
> > kernel space to user space.
> > Replace EBT_FUNCTION_MAXNAMELEN by XT_EXTENSION_MAXNAMELEN.
> 
> There's no information leak.
> 

Where do we clear "m"? 

include/linux/netfilter/x_tables.h
   287  struct xt_match {
   288          struct list_head list;
   289  
   290          const char name[XT_EXTENSION_MAXNAMELEN];
   291          u_int8_t revision;
   292  

There is a 2 byte holes here between "revision" and "match()".  We
copy three bytes past the end of name, so we include revision and
the hole.

But maybe we memset it somewhere?  I'm not sure.

   293          /* Return true or false: return FALSE and set *hotdrop = 1 to
   294             force immediate packet drop. */
   295          /* Arguments changed since 2.6.9, as this must now handle
   296             non-linear skb, using skb_header_pointer and
   297             skb_ip_make_writable. */
   298          bool (*match)(const struct sk_buff *skb,
   299                        struct xt_action_param *);

regards,
dan carpenter

Download attachment "signature.asc" of type "application/pgp-signature" (837 bytes)