linux-kernel - Re: CVE-2024-49995: tipc: guard against string buffer overrun

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1cc70ad0-4fa7-422f-ade4-b19a19ce3b61@stanley.mountain>
Date: Thu, 24 Apr 2025 11:17:01 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: Harshit Mogalapalli <harshit.m.mogalapalli@...cle.com>
Cc: cve@...nel.org, linux-kernel@...r.kernel.org,
	linux-cve-announce@...r.kernel.org,
	Simon Horman <simon.horman@...igine.com>,
	Dan Carpenter <error27@...il.com>,
	Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Subject: Re: CVE-2024-49995: tipc: guard against string buffer overrun

On Thu, Apr 24, 2025 at 11:41:01AM +0530, Harshit Mogalapalli wrote:
> Hi,
> 
> On 21/10/24 23:33, Greg Kroah-Hartman wrote:
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > tipc: guard against string buffer overrun
> > 
> > Smatch reports that copying media_name and if_name to name_parts may
> > overwrite the destination.
> > 
> >   .../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16)
> >   .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16)
> > 
> > This does seem to be the case so guard against this possibility by using
> > strscpy() and failing if truncation occurs.
> > 
> > Introduced by commit b97bf3fd8f6a ("[TIPC] Initial merge")
> > 
> > Compile tested only.
> > 
> > The Linux kernel CVE team has assigned CVE-2024-49995 to this issue.
> > 
> > 
> 
> Looking at the fix commit with more lines around the fix:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6555a2a9212be6983d2319d65276484f7c5f431a&context=30
> 
> 
>  	/* validate component parts of bearer name */
>  	if ((media_len <= 1) || (media_len > TIPC_MAX_MEDIA_NAME) ||
>  	    (if_len <= 1) || (if_len > TIPC_MAX_IF_NAME))
>  		return 0;
> 
>  	/* return bearer name components, if necessary */
>  	if (name_parts) {
> -		strcpy(name_parts->media_name, media_name);
> -		strcpy(name_parts->if_name, if_name);
> +		if (strscpy(name_parts->media_name, media_name,
> +			    TIPC_MAX_MEDIA_NAME) < 0)
> +			return 0;
> +		if (strscpy(name_parts->if_name, if_name,
> +			    TIPC_MAX_IF_NAME) < 0)
> +			return 0;
>  	}
>  	return 1;
> 
> 
> 
> both media_len and if_len have validation checks above the if(name_parts)
> check. So I think this patch just silences the static checker warnings.
> 
> Simon/Dan , could you please help confirming that ?

Correct.  The "validate component parts of bearer name" checks are
sufficient.  This will not affect runtime.

regards,
dan carpenter