linux-kernel - Re: [PATCHv2] netlink: Don't shift on 64 for ngroups

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 04 Aug 2018 17:53:42 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     dima@...sta.com
Cc:     linux-kernel@...r.kernel.org, natechancellor@...il.com,
        herbert@...dor.apana.org.au, steffen.klassert@...unet.com,
        netdev@...r.kernel.org, stable@...r.kernel.org
Subject: Re: [PATCHv2] netlink: Don't shift on 64 for ngroups

From: Dmitry Safonov <dima@...sta.com>
Date: Sun,  5 Aug 2018 01:35:53 +0100

> It's legal to have 64 groups for netlink_sock.
> 
> As user-supplied nladdr->nl_groups is __u32, it's possible to subscribe
> only to first 32 groups.
> 
> The check for correctness of .bind() userspace supplied parameter
> is done by applying mask made from ngroups shift. Which broke Android
> as they have 64 groups and the shift for mask resulted in an overflow.
> 
> Fixes: 61f4b23769f0 ("netlink: Don't shift with UB on nlk->ngroups")
> Reported-and-Tested-by: Nathan Chancellor <natechancellor@...il.com>
> Signed-off-by: Dmitry Safonov <dima@...sta.com>

Applied and queued up for -stable.