netdev - Re: [PATCH] SCTP: Fix possible memory leak while process INIT chunk with AUTH paramters

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 20 Mar 2008 08:24:52 -0400
From:	Vlad Yasevich <vladislav.yasevich@...com>
To:	Wei Yongjun <yjwei@...fujitsu.com>
Cc:	lksctp-developers@...ts.sourceforge.net, netdev@...r.kernel.org,
	David Miller <davem@...emloft.net>
Subject: Re: [PATCH] SCTP: Fix possible memory leak while process INIT chunk
 with AUTH paramters

Hi Wei

Wei Yongjun wrote:
> While endpoint received INIT/INIT-ACK chunk with AUTH parameters, such 
> as RANDOM, HMAC_ALGO, CHUNKS parameter, if those parameters appear more 
> then once, memory for store those parameters will be malloc more then 
> once and not free.
> 

All these parameters must be included only once in the packet.

If these things are included more then once, we should either ABORT or
completely ignore the packet.  I haven't decided which one makes more
sense yet.

If someone when to the trouble of violating the protocol, we should not
establish the association with them.

-vlad

> This patch change to used the first parameter and ignore the others.
> 
> Signed-off-by: Wei Yongjun <yjwei@...fujitsu.com>
> 
> --- a/net/sctp/sm_make_chunk.c    2008-02-11 17:14:05.000000000 -0500
> +++ b/net/sctp/sm_make_chunk.c    2008-02-14 03:57:58.000000000 -0500
> @@ -2458,6 +2458,9 @@ static int sctp_process_param(struct sct
>         if (!sctp_auth_enable)
>             goto fall_through;
> 
> +        if (asoc->peer.peer_random)
> +            break;
> +
>         /* Save peer's random parameter */
>         asoc->peer.peer_random = kmemdup(param.p,
>                         ntohs(param.p->length), gfp);
> @@ -2471,6 +2474,9 @@ static int sctp_process_param(struct sct
>         if (!sctp_auth_enable)
>             goto fall_through;
> 
> +        if (asoc->peer.peer_hmacs) +            break;
> +
>         /* Save peer's HMAC list */
>         asoc->peer.peer_hmacs = kmemdup(param.p,
>                         ntohs(param.p->length), gfp);
> @@ -2487,6 +2493,9 @@ static int sctp_process_param(struct sct
>         if (!sctp_auth_enable)
>             goto fall_through;
> 
> +        if (asoc->peer.peer_chunks)
> +            break;
> +
>         asoc->peer.peer_chunks = kmemdup(param.p,
>                         ntohs(param.p->length), gfp);
>         if (!asoc->peer.peer_chunks)
> 
> 
> 

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html