netdev - Re: [PATCH net] tun/tap: sanitize TUNSETSNDBUF input

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 1 Nov 2017 19:16:20 +0100
From:   "Jason A. Donenfeld" <Jason@...c4.com>
To:     Netdev <netdev@...r.kernel.org>
Cc:     Craig Gallek <kraigatgoog@...il.com>
Subject: Re: [PATCH net] tun/tap: sanitize TUNSETSNDBUF input

Here's a simple reproducer, in case Skyzaller's case was overcomplicated:

#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/types.h>
#include <sys/ioctl.h>
#include <linux/if.h>
#include <linux/if_tun.h>

int main(int argc, char *argv[])
{
  struct ifreq ifr;
  int fd, sock;

  fd = open("/dev/net/tun", O_RDWR);
  if (fd < 0) {
    perror("open(/dev/net/tun)");
    return 1;
  }

  memset(&ifr, 0, sizeof(ifr));

  ifr.ifr_flags = IFF_TUN;
  strncpy(ifr.ifr_name, "yikes", IFNAMSIZ);

  if (ioctl(fd, TUNSETIFF, &ifr) < 0) {
    perror("TUNSETIFF");
    return 1;
  }

  sock = socket(AF_INET, SOCK_DGRAM, 0);
  if (sock < 0) {
    perror("socket");
    return 1;
  }
  ifr.ifr_flags = IFF_UP;
  if (ioctl(sock, SIOCSIFFLAGS, &ifr) < 0) {
    perror("SIOCSIFFLAGS");
    return 1;
  }
  close(sock);

  sock = -1;
  if (ioctl(fd, TUNSETSNDBUF, &sock)) {
    perror("TUNSETSNDBUF");
    return 1;
  }

  if (write(fd, &fd, sizeof(fd)) < 0) {
    perror("write");
    return 1;
  }

  return 0;
}