lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ae2aae77-c194-4924-b698-4a499eabec5d@linaro.org>
Date:   Mon, 27 Nov 2023 11:10:51 +0100
From:   Krzysztof Kozlowski <krzysztof.kozlowski@...aro.org>
To:     Siddh Raman Pant <code@...dh.me>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc:     netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/4] nfc: Extract nfc_dev access from nfc_alloc_send_skb()
 into the callers

On 25/11/2023 21:26, Siddh Raman Pant wrote:
> The only reason why nfc_dev was accessed inside nfc_alloc_send_skb() is
> for getting the headroom and tailroom values.
> 
> This can cause UAF to be reported from nfc_alloc_send_skb(), but the
> callers are responsible for managing the device access, and thus the
> UAF being reported, as the callers (like nfc_llcp_send_ui_frame()) may
> repeatedly call this function, and this function will repeatedly try
> to get the same headroom and tailroom values.

I don't understand this sentence.

"This can cause ..., but ...". But starts another clause which should be
in contradictory to previous one.

> 
> Thus, put the nfc_dev access responsibility on the callers and accept
> the headroom and tailroom values directly.

Is this a fix or improvement? If fix, is the UAF real? If so, you miss
Fixes tag.


Best regards,
Krzysztof

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ