netdev - dhcpclient netlink bugs (was Re: [NETLINK]: Schedule removal of old macros exported to userspace)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 12 Dec 2006 07:56:30 +0100 (MET)
From:	Stefan Rompf <stefan@...lof.de>
To:	Thomas Graf <tgraf@...g.ch>
Cc:	netdev@...r.kernel.org, libc-alpha@...rceware.org
Subject: dhcpclient netlink bugs (was Re: [NETLINK]: Schedule removal of old
 macros exported to userspace)

Am Sonntag, 10. Dezember 2006 13:15 schrieb Thomas Graf:

> > Please send me the list of bugs you've spotted. Of course I want to fix
> > them.
>
> Sure...
>
> static void nl_handlemsg(struct nlmsghdr *msg, unsigned int len) {
>   if (len < sizeof(*msg)) return;
>
>   while(NLMSG_OK(msg,len)) {
>     if (nlcb_run &&
> 	nlcb_pid == msg->nlmsg_pid &&
> 	nlcb_seq == msg->nlmsg_seq) {
>       nlcb_function(msg, nlcb_args);
>
> Missing check for sufficient payload, family specific header
> and attributes are accessed directly, you've only made sure
> a netlink message header is present so far.

Yes, the code has quite some trust into the kernel that if it answers the 
asked question the answer is semantically correct. But to be fair, if you 
issue a write(), you also expect the number of bytes written in return and 
not the msec taken ;-) Will fix that and the other stuff you pointed out, 
thanks!

Stefan
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html