netdev - Re: [PATCH net-2.6] niu: Fix kernel buffer overflow for ETHTOOL

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Wed, 08 Sep 2010 14:03:59 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	bhutchings@...arflare.com
Cc:	netdev@...r.kernel.org, santwona.behera@....com
Subject: Re: [PATCH net-2.6] niu: Fix kernel buffer overflow for
 ETHTOOL_GRXCLSRLALL

From: Ben Hutchings <bhutchings@...arflare.com>
Date: Tue, 07 Sep 2010 15:35:19 +0100

> niu_get_ethtool_tcam_all() assumes that its output buffer is the right
> size, and warns before returning if it is not.  However, the output
> buffer size is under user control and ETHTOOL_GRXCLSRLALL is an
> unprivileged ethtool command.  Therefore this is at least a local
> denial-of-service vulnerability.
> 
> Change it to check before writing each entry and to return an error if
> the buffer is already full.
> 
> Compile-tested only.
> 
> Signed-off-by: Ben Hutchings <bhutchings@...arflare.com>

Good catch, thanks Ben.

> There may be more of these but AFAIK this is the only RXNFC command that
> deals with variable-length data.
> 
> I wonder whether it really makes sense for ethtool getter commands to be
> generally unprivileged.  Does the convenience outweigh the risk of a
> driver bug becoming a local DoS or root hole, or the disclosure of
> information such as (in this case) which flows the administrator
> considers interesting?

I'm ambivalent about this specific case, to be honest.  Although one
argument for what we do now is that often admins do things as root
as little as possible and this helps that.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html