lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <51ea1522-edc2-bd15-2873-0712e7eb49c3@auristor.com>
Date:   Sat, 27 May 2023 10:45:10 -0400
From:   Jeffrey E Altman <jaltman@...istor.com>
To:     Andrew Lunn <andrew@...n.ch>, Kenny Ho <y2kenny@...il.com>
Cc:     Marc Dionne <marc.dionne@...istor.com>,
        Kenny Ho <Kenny.Ho@....com>,
        David Howells <dhowells@...hat.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, linux-afs@...ts.infradead.org,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] Remove hardcoded static string length

On 5/24/2023 1:43 PM, Andrew Lunn wrote:
> On Wed, May 24, 2023 at 01:02:36PM -0400, Kenny Ho wrote:
>> On Wed, May 24, 2023 at 12:02 PM Andrew Lunn <andrew@...n.ch> wrote:
>>> So the compiler warning/error needs to be fixed a different want.
>> Understood.  Would caping the length at iov_len with a ternary be sufficient?
> The quoted text said 'string'. It is not clear if that means c-string,
> with a trailing \0. If you just cap iov_len you could end up with a
> string which is not terminated.
The expected buffer is a NUL terminated c-string.
> The other end of the socket should not blow up, because that would be
> an obvious DOS or buffer overwrite attack vector.

This is a valid concern because all versions of IBM AFS 3.6 Rx and 
OpenAFS Rx prior to 1.6.23 are susceptible to read beyond the end of 
buffer if either the received data is longer than 65 octets or the 
received data is 65 octets but not NUL terminated.

Jeffrey Altman



Download attachment "smime.p7s" of type "application/pkcs7-signature" (4039 bytes)

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ