netdev - Re: [PATCH V2] netfilter: h323: avoid potential attack

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1453985821.7627.17.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Thu, 28 Jan 2016 04:57:01 -0800
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Zhouyi Zhou <zhouzhouyi@...il.com>
Cc:	pablo@...filter.org, kaber@...sh.net, kadlec@...ckhole.kfki.hu,
	davem@...emloft.net, netfilter-devel@...r.kernel.org,
	coreteam@...filter.org, netdev@...r.kernel.org,
	linux-kernel@...r.kernel.or, Zhouyi Zhou <yizhouzhou@....ac.cn>
Subject: Re: [PATCH V2] netfilter: h323: avoid potential attack

On Thu, 2016-01-28 at 16:59 +0800, Zhouyi Zhou wrote:
> Thanks Eric for your review and advice.
> 
> I think hackers chould build a malicious h323 packet to overflow
> the pointer p which will panic during the memcpy(addr, p, len)
> 
> For example, he may fabricate a very large taddr->ipAddress.ip;
> 
> Signed-off-by: Zhouyi Zhou <yizhouzhou@....ac.cn>
> ---

Except you did not address my feedback about potentially reading not
initialized memory.

if the frame length was 1000 bytes, then surely accessing memory at
offset 8000 will either read garbage, or read data from a prior frame
and leak secrets.