netdev - Re: use after free bug in socket code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <19035.23045.386506.297464@ipc1.ka-ro>
Date:	Mon, 13 Jul 2009 18:00:05 +0200
From:	Lothar Waßmann <LW@...O-electronics.de>
To:	Herbert Xu <herbert@...dor.apana.org.au>
Cc:	davem@...emloft.net, netdev@...r.kernel.org,
	urs.thuermann@...kswagen.de, oliver.hartkopp@...kswagen.de
Subject: Re: use after free bug in socket code

Hi,

Herbert Xu writes:
> Lothar Waßmann <LW@...o-electronics.de> wrote:
> >
> > So, could you point me to the place where the reference count of the
> > socket object is being incremented when a struct sock is associated
> > with it?
> 
> It's implicit.  Anyway, you should remodel your release function
> on a working protocol.
> 
OK. I checked the release functions of the can raw and bcm protocols
and found that they obviously are the culprits since they lack the
call to sock_orphan that other network protocol drivers have:

diff -ur linux-2.6.30/net/can/bcm.c linux-2.6.30-karo/net/can/bcm.c
--- linux-2.6.30/net/can/bcm.c	2009-06-10 05:05:27.000000000 +0200
+++ linux-2.6.30-karo/net/can/bcm.c	2009-07-12 20:12:38.000000000 +0200
@@ -1469,6 +1469,9 @@
 		bo->ifindex = 0;
 	}
 
+	sock_orphan(sk);
+	sock->sk = NULL;
+
 	release_sock(sk);
 	sock_put(sk);
 
diff -ur linux-2.6.30/net/can/raw.c linux-2.6.30-karo/net/can/raw.c
--- linux-2.6.30/net/can/raw.c	2009-06-10 05:05:27.000000000 +0200
+++ linux-2.6.30-karo/net/can/raw.c	2009-07-12 20:12:29.000000000 +0200
@@ -306,6 +306,9 @@
 	ro->bound   = 0;
 	ro->count   = 0;
 
+	sock_orphan(sk);
+	sock->sk = NULL;
+
 	release_sock(sk);
 	sock_put(sk);
 


Could someone of the CAN-Folks comment on this?


Best regards,
Lothar Waßmann
-- 
___________________________________________________________

Ka-Ro electronics GmbH | Pascalstraße 22 | D - 52076 Aachen
Phone: +49 2408 1402-0 | Fax: +49 2408 1402-10
Geschäftsführer: Matthias Kaussen
Handelsregistereintrag: Amtsgericht Aachen, HRB 4996

www.karo-electronics.de | info@...o-electronics.de
___________________________________________________________
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html