netdev - [iproute2 2/2] ss: fix NULL pointer access when parsing unix sockets with oldformat

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20180106183150.10530-2-a@unstable.cc>
Date:   Sun,  7 Jan 2018 02:31:50 +0800
From:   Antonio Quartulli <a@...table.cc>
To:     netdev@...r.kernel.org
Cc:     Antonio Quartulli <a@...table.cc>,
        Stefano Brivio <sbrivio@...hat.com>,
        Stephen Hemminger <stephen@...workplumber.org>
Subject: [iproute2 2/2] ss: fix NULL pointer access when parsing unix sockets with oldformat

When parsing and printing the unix sockets in unix_show(),
if the oldformat is detected, the peer_name member of the sockstat
object is left uninitialized (NULL).
For this reason, if a filter has been specified on the command line,
a strcmp() will crash when trying to access it.

Avoid crash by checking that peer_name is not NULL before
passing it to strcmp().

Cc: Stefano Brivio <sbrivio@...hat.com>
Cc: Stephen Hemminger <stephen@...workplumber.org>
Signed-off-by: Antonio Quartulli <a@...table.cc>
---

To crash ss, simply execute the following on a system using the old
socket format:
ss -x dst 192.168.1.1
or
ss dst 192.168.1.1

(crash reproduced on linux-4.12.12)


 misc/ss.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/misc/ss.c b/misc/ss.c
index b35859dc..29a25070 100644
--- a/misc/ss.c
+++ b/misc/ss.c
@@ -3711,7 +3711,10 @@ static int unix_show(struct filter *f)
 			};
 
 			memcpy(st.local.data, &u->name, sizeof(u->name));
-			if (strcmp(u->peer_name, "*"))
+			/* when parsing the old format rport is set to 0 and
+			 * therefore peer_name remains NULL
+			 */
+			if (u->peer_name && strcmp(u->peer_name, "*"))
 				memcpy(st.remote.data, &u->peer_name,
 				       sizeof(u->peer_name));
 			if (run_ssfilter(f->f, &st) == 0) {
-- 
2.15.1