linux-kernel - Re: [net] seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Thu, 04 Jun 2020 15:40:20 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     ahabdels@...il.com
Cc:     kuba@...nel.org, ast@...nel.org, daniel@...earbox.net,
        kafai@...com, songliubraving@...com, yhs@...com, andriin@...com,
        john.fastabend@...il.com, kpsingh@...omium.org,
        kuznet@....inr.ac.ru, yoshfuji@...ux-ipv6.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org,
        bpf@...r.kernel.org, yuehaibing@...wei.com, eric.dumazet@...il.com,
        david.lebrun@...ouvain.be
Subject: Re: [net] seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds

From: Ahmed Abdelsalam <ahabdels@...il.com>
Date: Wed,  3 Jun 2020 06:54:42 +0000

> The seg6_validate_srh() is used to validate SRH for three cases:
> 
> case1: SRH of data-plane SRv6 packets to be processed by the Linux kernel.
> Case2: SRH of the netlink message received  from user-space (iproute2)
> Case3: SRH injected into packets through setsockopt
> 
> In case1, the SRH can be encoded in the Reduced way (i.e., first SID is
> carried in DA only and not represented as SID in the SRH) and the
> seg6_validate_srh() now handles this case correctly.
> 
> In case2 and case3, the SRH shouldn’t be encoded in the Reduced way
> otherwise we lose the first segment (i.e., the first hop).
> 
> The current implementation of the seg6_validate_srh() allow SRH of case2
> and case3 to be encoded in the Reduced way. This leads a slab-out-of-bounds
> problem.
> 
> This patch verifies SRH of case1, case2 and case3. Allowing case1 to be
> reduced while preventing SRH of case2 and case3 from being reduced .
> 
> Reported-by: syzbot+e8c028b62439eac42073@...kaller.appspotmail.com
> Reported-by: YueHaibing <yuehaibing@...wei.com>
> Fixes: 0cb7498f234e ("seg6: fix SRH processing to comply with RFC8754")
> Signed-off-by: Ahmed Abdelsalam <ahabdels@...il.com>

Applied, thanks.