linux-kernel - Re: [PATCH] net: sendmsg: fix NULL pointer dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20140729.122106.1193653186424252040.davem@davemloft.net>
Date:	Tue, 29 Jul 2014 12:21:06 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	ryabinin.a.a@...il.com
Cc:	hannes@...essinduktion.org, edumazet@...gle.com,
	netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
	sasha.levin@...cle.com, a.ryabinin@...sung.com,
	stable@...r.kernel.org
Subject: Re: [PATCH] net: sendmsg: fix NULL pointer dereference

From: Andrey Ryabinin <ryabinin.a.a@...il.com>
Date: Sat, 26 Jul 2014 21:26:58 +0400

> Sasha's report:
 ...
> This reports means that we've come to netlink_sendmsg() with msg->msg_name == NULL and msg->msg_namelen > 0.
> 
> After this report there was no usual "Unable to handle kernel NULL pointer dereference"
> and this gave me a clue that address 0 is mapped and contains valid socket address structure in it.
> 
> This bug was introduced in f3d3342602f8bcbf37d7c46641cb9bca7618eb1c
> (net: rework recvmsg handler msg_name and msg_namelen logic).
> Commit message states that:
> 	"Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
> 	 non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
> 	 affect sendto as it would bail out earlier while trying to copy-in the
> 	 address."
> But in fact this affects sendto when address 0 is mapped and contains
> socket address structure in it. In such case copy-in address will succeed,
> verify_iovec() function will successfully exit with msg->msg_namelen > 0
> and msg->msg_name == NULL.
> 
> This patch fixes it by setting msg_namelen to 0 if msg_name == NULL.
> 
> Cc: Hannes Frederic Sowa <hannes@...essinduktion.org>
> Cc: Eric Dumazet <edumazet@...gle.com>
> Cc: <stable@...r.kernel.org>
> Reported-by: Sasha Levin <sasha.levin@...cle.com>
> Signed-off-by: Andrey Ryabinin <a.ryabinin@...sung.com>

Applied and queued up for -stable, thanks!
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/