netdev - Re: [PATCH] rtnetlink: Mask the rta

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20130317.114449.191991112324521259.davem@davemloft.net>
Date:	Sun, 17 Mar 2013 11:44:49 -0400 (EDT)
From:	David Miller <davem@...emloft.net>
To:	tgraf@...g.ch
Cc:	vyasevic@...hat.com, stephen@...workplumber.org,
	netdev@...r.kernel.org
Subject: Re: [PATCH] rtnetlink: Mask the rta_type when range checking

From: Thomas Graf <tgraf@...g.ch>
Date: Fri, 15 Mar 2013 08:51:24 +0000

> On 03/14/13 at 08:30pm, Vlad Yasevich wrote:
>> Doing a quick check on all the callers for rtnl_register and their
>> handlers the following do not use nla_parse:
>>  1) dn_fib_rtm_newroute/delroute  - Don't seem to care about attribute
>>                                     types.
>>  2) dn_cache_getroute() - suspect use.  relies on rta_buf populated by
>>                           rtnetlink_rcv_msg
>> 
>>  3) inet_rtm_newroute/delroute - rtm_to_fib_config() uses a custom loop
>>                                   with nla_type(), so safe.
>> 
>> That's all that a quick look finds.  Out of all of them, looks like
>> on dn_cache_getroute() would be broken.
> 
> So checking values in rta_max[] which lists the maximum attribute
> allowed for each message family range, all are limited to low
> values so the NLA_F_NESTED bit is guaranteed to have been unused
> up to now.
> 
> The risk that remains is that we would start accepting an attribute
> which we previously didn't but we have that risk with every new
> attribute that is added.
> 
> Acked-by: Thomas Graf <tgraf@...g.ch>

Applied and queued up for -stable.  And also agreed that abstracting the
rtnetlink attribute parsing out properly is the way to go.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html