lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 30 Jul 2014 09:21:08 -0400 From: Sasha Levin <sasha.levin@...cle.com> To: kuznet@....inr.ac.ru, davem@...emloft.net, jmorris@...ei.org, yoshfuji@...ux-ipv6.org, kaber@...sh.net Cc: netdev@...r.kernel.org, linux-kernel@...r.kernel.org, Sasha Levin <sasha.levin@...cle.com> Subject: [PATCH] net: ipv4: raw: don't agree to 0 sized headers For raw sockets, we'd always assume that a header is supplied and will attempt to copy it into the ip header space using memcpy_fromiovecend(): if (memcpy_fromiovecend((void *)iph, from, 0, length)) goto error_free; The problem is that memcpy_fromiovecend() assumes that there are actual data to read from the iovec and doesn't deal with cases where there are none: int memcpy_fromiovecend(unsigned char *kdata, const struct iovec *iov, int offset, int len) { /* Skip over the finished iovecs */ while (offset >= iov->iov_len) { offset -= iov->iov_len; iov++; } [...] So when offset == 0 and iov->iov_len == 0, we'll just run iov into random kernel memory until it hits something bad and dies in a BUG/panic - either killing the kernel or leaking memory and held locks. Signed-off-by: Sasha Levin <sasha.levin@...cle.com> --- net/ipv4/raw.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c index 739db31..3af59ee 100644 --- a/net/ipv4/raw.c +++ b/net/ipv4/raw.c @@ -345,6 +345,10 @@ static int raw_send_hdrinc(struct sock *sk, struct flowi4 *fl4, rt->dst.dev->mtu); return -EMSGSIZE; } + + if (length == 0) + return -EINVAL; + if (flags&MSG_PROBE) goto out; -- 1.7.10.4 -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists