lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Thu, 21 Aug 2014 16:45:11 -0700 (PDT) From: David Miller <davem@...emloft.net> To: eric.dumazet@...il.com Cc: hannes@...essinduktion.org, dborkman@...hat.com, nhorman@...driver.com, brouer@...hat.com, netdev@...r.kernel.org, guy@...m.mit.edu Subject: Re: [PATCH v1 net] packet: handle too big packets for PACKET_V3 From: Eric Dumazet <eric.dumazet@...il.com> Date: Fri, 15 Aug 2014 09:16:04 -0700 > From: Eric Dumazet <edumazet@...gle.com> > > af_packet can currently overwrite kernel memory by out of bound > accesses, because it assumed a [new] block can always hold one frame. > > This is not generally the case, even if most existing tools do it right. > > This patch clamps too long frames as API permits, and issue a one time > error on syslog. > > [ 394.357639] tpacket_rcv: packet too big, clamped from 5042 to 3966. macoff=82 > > In this example, packet header tp_snaplen was set to 3966, > and tp_len was set to 5042 (skb->len) > > Signed-off-by: Eric Dumazet <edumazet@...gle.com> > Fixes: f6fb8f100b80 ("af-packet: TPACKET_V3 flexible buffer implementation.") Since both the skb->len and the snaplen are provided to the user in the ring entry descriptor, it is correct to fix this problem by simply truncating. Applied and queued up for -stable, thanks a lot Eric. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists