netdev - Re: [BUG] icmpv6fuzz creates bad paging request

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20090102085943.GA25100@gondor.apana.org.au>
Date:	Fri, 2 Jan 2009 19:59:43 +1100
From:	Herbert Xu <herbert@...dor.apana.org.au>
To:	Eric Sesterhenn <snakebyte@....de>
Cc:	netdev@...r.kernel.org, davem@...emloft.net,
	yoshfuji@...ux-ipv6.org, Yang Hongyang <yanghy@...fujitsu.com>
Subject: Re: [BUG] icmpv6fuzz creates bad paging request

On Thu, Jan 01, 2009 at 08:13:04PM +0000, Eric Sesterhenn wrote:
> 
> running "icmpv6fuzz -r 2187" gives me the following oops with current -git

Thanks, this should fix it:

ipv6: Fix memory overrun in do_ipv6_setsockopt

The newly added IPV6_PKTINFO option uses the user-supplied length
without checking, thus overwriting kernel stack memory if a bogus
value is provided.

This patch fixes it by capping the size to that of struct in6_pktinfo.

Signed-off-by: Herbert Xu <herbert@...dor.apana.org.au>

diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
index eeeaad2..0df4b10 100644
--- a/net/ipv6/ipv6_sockglue.c
+++ b/net/ipv6/ipv6_sockglue.c
@@ -399,15 +399,13 @@ sticky_done:
 	{
 		struct in6_pktinfo pkt;
 
-		if (optlen == 0)
-			goto e_inval;
-		else if (optlen < sizeof(struct in6_pktinfo) || optval == NULL)
+		if (optlen < sizeof(pkt))
 			goto e_inval;
 
-		if (copy_from_user(&pkt, optval, optlen)) {
-				retv = -EFAULT;
-				break;
-		}
+		retv = -EFAULT;
+		if (copy_from_user(&pkt, optval, sizeof(pkt)))
+			break;
+
 		if (sk->sk_bound_dev_if && pkt.ipi6_ifindex != sk->sk_bound_dev_if)
 			goto e_inval;

Thanks,
-- 
Visit Openswan at http://www.openswan.org/
Email: Herbert Xu ~{PmV>HI~} <herbert@...dor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html