linux-kernel - Re: [PATH nf v3] netfilter/osf: avoid OOB read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20230905220124.GD28379@breakpoint.cc>
Date:   Wed, 6 Sep 2023 00:01:24 +0200
From:   Florian Westphal <fw@...len.de>
To:     Wander Lairson Costa <wander@...hat.com>
Cc:     Pablo Neira Ayuso <pablo@...filter.org>,
        Jozsef Kadlecsik <kadlec@...filter.org>,
        Florian Westphal <fw@...len.de>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Fernando Fernandez Mancera <ffmancera@...eup.net>,
        "open list:NETFILTER" <netfilter-devel@...r.kernel.org>,
        "open list:NETFILTER" <coreteam@...filter.org>,
        "open list:NETWORKING [GENERAL]" <netdev@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>,
        Lucas Leong <wmliang@...osec.exchange>, stable@...nel.org
Subject: Re: [PATH nf v3] netfilter/osf: avoid OOB read

Wander Lairson Costa <wander@...hat.com> wrote:
> The opt_num field is controlled by user mode and is not currently
> validated inside the kernel. An attacker can take advantage of this to
> trigger an OOB read and potentially leak information.
> 
> Also add validation to genre, subtype and version fields.

I was about to apply this but your patch misses the Signed-off-by line.

> Reproducer:
> 
> void install_filter_for_leak()
> {

Please remove this for v4, it only clutters the changelog.

> KASAN report:
> 
> ==================================================================
> BUG: KASAN: slab-out-of-bounds in nf_osf_match_one+0xbed/0xd10 linux-6.0-rc4/net/netfilter/nfnetlink_osf.c:88
> Read of size 2 at addr ffff88804bc64272 by task poc/6431
> 
> CPU: 1 PID: 6431 Comm: poc Not tainted 6.0.0-rc4 #1
> Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
> Call Trace:
>  <IRQ>
>  __dump_stack linux-6.0-rc4/lib/dump_stack.c:88
>  dump_stack_lvl+0xcd/0x134 linux-6.0-rc4/lib/dump_stack.c:106
>  print_address_description linux-6.0-rc4/mm/kasan/report.c:317
>  print_report.cold+0x2ba/0x6e9 linux-6.0-rc4/mm/kasan/report.c:433
>  kasan_report+0xb1/0x1e0 linux-6.0-rc4/mm/kasan/report.c:495
>  nf_osf_match_one+0xbed/0xd10 linux-6.0-rc4/net/netfilter/nfnetlink_osf.c:88
>  nf_osf_find+0x186/0x2f0 linux-6.0-rc4/net/netfilter/nfnetlink_osf.c:281
>  nft_osf_eval+0x37f/0x590 linux-6.0-rc4/net/netfilter/nft_osf.c:47
>  expr_call_ops_eval linux-6.0-rc4/net/netfilter/nf_tables_core.c:214
>  nft_do_chain+0x2b0/0x1490 linux-6.0-rc4/net/netfilter/nf_tables_core.c:264
>  nft_do_chain_ipv4+0x17c/0x1f0 linux-6.0-rc4/net/netfilter/nft_chain_filter.c:23
>  nf_hook_entry_hookfn linux-6.0-rc4/./include/linux/netfilter.h:142
>  nf_hook_slow+0xc5/0x1f0 linux-6.0-rc4/net/netfilter/core.c:620

You can keep the KASAN splat but please trim it down, anything below
here
doesn't add much value and neither does print_address_description etc.
above.

>  ffff88804bc64300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
> 
> ---

git-am chopped everything below off, so

> 
> Fixes: f9324952088f ("netfilter: nfnetlink_osf: extract nfnetlink_subsystem code from xt_osf.c")
> Reported-by: Lucas Leong <wmliang@...osec.exchange>
> Cc: stable@...nel.org
> Signed-off-by: Wander Lairson Costa <wander@...hat.com>

The above wasn't there when I looked at 'git log'.

I will fix this up locally, no need to resend,
but please keep this in mind next time.

Thanks!