netdev - Re: [PATCH 2/2] [IPV6]: Ensure to truncate result and return full length for sticky options.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20070309234435.GE7920@sequoia.sous-sol.org>
Date:	Fri, 9 Mar 2007 15:44:35 -0800
From:	Chris Wright <chrisw@...s-sol.org>
To:	David Miller <davem@...emloft.net>
Cc:	yoshfuji@...ux-ipv6.org, chrisw@...s-sol.org,
	netdev@...r.kernel.org
Subject: Re: [PATCH 2/2] [IPV6]: Ensure to truncate result and return full length for sticky options.

* David Miller (davem@...emloft.net) wrote:
> From: YOSHIFUJI Hideaki / 吉藤英明 <yoshfuji@...ux-ipv6.org>
> Date: Fri, 09 Mar 2007 10:13:28 +0900 (JST)
> 
> > Bug noticed by Chris Wright <chrisw@...s-sol.org>.
> > 
> > Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@...ux-ipv6.org>
> 
> Applied, thanks a lot.

Crud, I should have noticed this earlier.  This has a problem, min_t(int)
means user supplied < 0 is a large copy_to_user (back to leaking memory
on arch's that don't protect < 0 copy_to_user like i386 does).  Here's
a simple fix ontop of yoshifuji's two changes.  Hope that's it ;-)

thanks,
-chris
--

From: Chris Wright <chrisw@...s-sol.org>
Subject: [IPV6] fix ipv6_getsockopt_sticky copy_to_user leak

User supplied len < 0 can cause leak of kernel memory.
Use unsigned compare instead.

Signed-off-by: Chris Wright <chrisw@...s-sol.org>
---
 net/ipv6/ipv6_sockglue.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index a4f06ce..321287b 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -824,7 +824,7 @@ static int ipv6_getsockopt_sticky(struct sock *sk, struct ipv6_txoptions *opt,
 	if (!hdr)
 		return 0;
 
-	len = min_t(int, len, ipv6_optlen(hdr));
+	len = min_t(unsigned, len, ipv6_optlen(hdr));
 	if (copy_to_user(optval, hdr, len));
 		return -EFAULT;
 	return ipv6_optlen(hdr);
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html