linux-kernel - Re: staging: possible buffer overflow in rtw_wx_set_scan function in driver/staging/rtl8723bs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20210824074643.GA1731@agape.jhs>
Date:   Tue, 24 Aug 2021 09:46:44 +0200
From:   Fabio Aiuto <fabioaiuto83@...il.com>
To:     iLifetruth <yixiaonn@...il.com>
Cc:     gregkh@...uxfoundation.org, ross.schm.dev@...il.com,
        marcocesati@...il.com, insafonov@...il.com,
        linux-kernel@...r.kernel.org, Qiang Liu <cyruscyliu@...il.com>,
        yajin@...kernel.org, hdegoede@...hat.com,
        Larry.Finger@...inger.net, Martin Kaiser <martin@...ser.cx>,
        Phillip Potter <phil@...lpotter.co.uk>,
        Michael Straube <straube.linux@...il.com>,
        fmdefrancesco@...il.com, linux-staging@...ts.linux.dev,
        paskripkin@...il.com
Subject: Re: staging: possible buffer overflow in rtw_wx_set_scan function in
 driver/staging/rtl8723bs

Hello,

[sorry for resend, I updated the CC field]

On Tue, Aug 24, 2021 at 03:04:04PM +0800, iLifetruth wrote:
> Here are the fixes and the contents of the patch file we suggest.
> 
> [PATCH]staging: rtl8723bs: prevent ->ssid overflow in rtw_wx_set_scan()
> 
> This fixing patch is ported from the upstream commit
> 74b6b20df8cf(staging: rtl8188eu: prevent ->ssid overflow in
> rtw_wx_set_scan()) which fixes on another driver numbered rtl8188eu.
> This code has a check to prevent read overflow but it needs another
> check to prevent writing beyond the end of the ->ssid[] array in
> driver rtl8723bs.
> 
> ---
>  drivers/staging/rtl8723bs/os_dep/ioctl_linux.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> index f95000df8942..3b859b71bf43 100644
> --- a/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> +++ b/drivers/staging/rtl8723bs/os_dep/ioctl_linux.c
> @@ -1222,9 +1222,9 @@ static int rtw_wx_set_scan(struct net_device
> *dev, struct iw_request_info *a,
> 
>                                 sec_len = *(pos++); len -= 1;
> 
> -                               if (sec_len > 0 && sec_len <= len) {
> +                               if (sec_len > 0 && sec_len <= len &&
> sec_len<= 32) {
>                                         ssid[ssid_index].SsidLength = sec_len;
> -                                       memcpy(ssid[ssid_index].Ssid,
> pos, ssid[ssid_index].SsidLength);
> +                                       memcpy(ssid[ssid_index].Ssid,
> pos, sec_len);
>                                         ssid_index++;
>                                 }
> 
> --
> 
> Thanks for your confirmation,
> - iLifetruth
> 

the patch looks fine. Just some points:

- If the patch related to wext support removal will
  be accepted, the patch isn't necessary. So I will wait
  until I know the community-maintainer decision.


> 
> On Tue, Aug 24, 2021 at 10:07 AM iLifetruth <yixiaonn@...il.com> wrote:
> >
> > I haven't committed the patch yet since the Linux staging tree may
> > seem special. It's not clear to me where to submit the patch. So could
> > you please fix it?
> >
> > Regards and thanks for your confirmation,
> > - iLifetruth
> >
> >
> > On Tue, Aug 24, 2021 at 1:08 AM Fabio Aiuto <fabioaiuto83@...il.com> wrote:
> > >
> > > Hello,
> > >
> > > On Mon, Aug 23, 2021 at 11:19:09PM +0800, iLifetruth wrote:
> > > > Hi, in the latest version of Linux staging tree, we may have found an
> > > > unfixed security bug in the staging/driver/rtl8723bs related to the
> > > > CVE-2021-28660. Now, we would like to contact you to confirm this
> > > > problem.
> > > >
> > > > ===========
> > > > Here is the description of CVE-2021-28660:
> > > >
> > > > "It was discovered that the rtl8188eu WiFi driver did not correctly
> > > > limit the length of SSIDs copied into scan results. An attacker within
> > > > WiFi range could use this to cause a denial of service (crash or
> > > > memory corruption) or possibly to execute code on a vulnerable
> > > > system."
> > > >
> > > > ===========
> > > > The staging driver "rtl8188eu" was fixed by commit
> > > > 74b6b20df8cfe90ada777d621b54c32e69e27cd7 on 2021-03-10.

- The driver rtl8188eu is deprecated. Now exists r8188eu which has
  the same security bug, so it needs to be fixed. Again feel free
  to submit your own patch.

- If you decide to submit your own patch I suggest to put
  your full name in the email address as you submitted a legal
  document.
  
  vim 409+ Documentation/process/submitting-patches.rst

> > > >
> > > > However, in another similar staging driver numbered "rtl8723bs", a
> > > > function named “rtw_wx_set_scan” remains the same problem unfixed. And
> > > > it is detected in the
> > > > “drivers/staging/rtl8723bs/os_dep/ioctl_linux.c#Line1354" without
> > > > checking to prevent writing beyond the end of the ->ssid[] array.
> > > >
> > > > Therefore, shall we port the same fix from RTL8188EU to RTL8723BS?
> > >
> > > I think it's a good idea, moreover I've just sent a patch series
> > > aimed at removing that piece of code for it belongs to very
> > > old wext implementation.
> > >
> > > But until it's not accepted by the maintainer that security bug
> > > is present and harmful. If you fix it thank you, if you don't
> > > thank you for reporting this, I will fix as soon as possible.
> > >
> > > >
> > > > Thank you!
> > >
> > > thank you,
> > >
> > > fabio

thank you for your report,

fabio