netdev - Re: Possible bit/byte conversion mistake in xfrm

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <5291E90F.2060902@windriver.com>
Date:	Sun, 24 Nov 2013 19:54:55 +0800
From:	Fan Du <fan.du@...driver.com>
To:	"Marksteiner, Stefan" <stefan.marksteiner@...nneum.at>
CC:	<netdev@...r.kernel.org>
Subject: Re: Possible bit/byte conversion mistake in xfrm_state.c

Please wrap the line in shorter length ;)

On 2013年11月22日 22:54, Marksteiner, Stefan wrote:
> Hi folks,
>
> I might have found a little bit/byte mistake in xfrm_state.c of iproute2-3.11.0 (and also lower versions).
>
> In line 169 the algorithm length is set correctly ("alg->alg_key_len = len * 8;") in bits (as it is supposed by /usr/include/linux/xfrm.h, line 101), but later in line 496 the same value is read and added to a length value in bytes ("len += alg.u.alg.alg_key_len;").
>
> I'm not completetly sure, but I'm wondering if this might lead to errors for algorithms with big key sizes (>2048 bits) for the key buffer ("char buf[RTA_BUF_SIZE]" in line 274) reserves only 2048 bytes of memory (RTA_BUF_SIZE=2048). So taking bits for bytes, the following memcopy operation may overwrite adjacent memory areas.
>
> Can somebody verify if this is in fact an issue? Maybe I'm reading this whole stuff wrong.

You are totally right about this bit/byte mistake here.

Normally the aes key len is 128bits, and 160bits for sha1, and
the key buf  defined here is XFRM_ALGO_KEY_BUF_SIZE 512 bytes,
so there are stale data append after each key content, although
is not used by key interface anyway, which means the IPsec
communication goes well after all.

-- 
浮沉随浪只记今朝笑

--fan fan
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html