netdev - Re: [PATCH net] xfrm: defer daddr pointer assignment after spi parsing

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20171103071618.GN11292@secunet.com>
Date:   Fri, 3 Nov 2017 08:16:18 +0100
From:   Steffen Klassert <steffen.klassert@...unet.com>
To:     Florian Westphal <fw@...len.de>
CC:     <netdev@...r.kernel.org>, <syzkaller-bugs@...glegroups.com>,
        <herbert@...dor.apana.org.au>
Subject: Re: [PATCH net] xfrm: defer daddr pointer assignment after spi
 parsing

On Wed, Nov 01, 2017 at 08:30:49PM +0100, Florian Westphal wrote:
> syzbot reports:
> BUG: KASAN: use-after-free in __xfrm_state_lookup+0x695/0x6b0
> Read of size 4 at addr ffff8801d434e538 by task syzkaller647520/2991
> [..]
> __xfrm_state_lookup+0x695/0x6b0 net/xfrm/xfrm_state.c:833
> xfrm_state_lookup+0x8a/0x160 net/xfrm/xfrm_state.c:1592
> xfrm_input+0x8e5/0x22f0 net/xfrm/xfrm_input.c:302
> 
> The use-after-free is the ipv4 destination address, which points
> to an skb head area that has been reallocated:
>   pskb_expand_head+0x36b/0x1210 net/core/skbuff.c:1494
>   __pskb_pull_tail+0x14a/0x17c0 net/core/skbuff.c:1877
>   pskb_may_pull include/linux/skbuff.h:2102 [inline]
>   xfrm_parse_spi+0x3d3/0x4d0 net/xfrm/xfrm_input.c:170
>   xfrm_input+0xce2/0x22f0 net/xfrm/xfrm_input.c:291
> 
> so the real bug is that xfrm_parse_spi() uses pskb_may_pull, but
> for now do smaller workaround that makes xfrm_input fetch daddr
> after spi parsing.
> 
> Reported-by: syzbot <syzkaller@...glegroups.com>
> Signed-off-by: Florian Westphal <fw@...len.de>

Applied, thanks Florian!