netdev - Re: [PATCH 1/1] NFC: Fix possible memory corruption when handling SHDLC I-Frame commands

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAGXu5jJGxr8fEJDEVciDo1VcF95brx31fAWV0ydYQj6Nq81MqQ@mail.gmail.com>
Date:   Mon, 13 Aug 2018 17:28:24 -0700
From:   Kees Cook <keescook@...omium.org>
To:     Suren Baghdasaryan <surenb@...gle.com>
Cc:     Security Officers <security@...nel.org>, kdeus@...gle.com,
        Samuel Ortiz <sameo@...ux.intel.com>,
        "David S. Miller" <davem@...emloft.net>,
        Allen Pais <allen.pais@...cle.com>,
        linux-wireless <linux-wireless@...r.kernel.org>,
        Network Development <netdev@...r.kernel.org>,
        LKML <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 1/1] NFC: Fix possible memory corruption when handling
 SHDLC I-Frame commands

On Mon, Aug 13, 2018 at 3:39 PM, Suren Baghdasaryan <surenb@...gle.com> wrote:
> When handling SHDLC I-Frame commands "pipe" field used for indexing
> into an array should be checked before usage. If left unchecked it
> might access memory outside of the array of size NFC_HCI_MAX_PIPES(127).
>
> Malformed NFC HCI frames could be injected by a malicious NFC device
> communicating with the device being attacked (remote attack vector),
> or even by an attacker with physical access to the I2C bus such that
> they could influence the data transfers on that bus (local attack vector).
> skb->data is controlled by the attacker and has only been sanitized in
> the most trivial ways (CRC check), therefore we can consider the
> create_info struct and all of its members to tainted. 'create_info->pipe'
> with max value of 255 (uint8) is used to take an offset of the
> hdev->pipes array of 127 elements which can lead to OOB write.
>
> Suggested-by: Kevin Deus <kdeus@...gle.com>
> Signed-off-by: Suren Baghdasaryan <surenb@...gle.com>

Nice find!

Acked-by: Kees Cook <keescook@...omium.org>

> ---
>  net/nfc/hci/core.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
>
> diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
> index ac8030c4bcf8..19cb2e473ea6 100644
> --- a/net/nfc/hci/core.c
> +++ b/net/nfc/hci/core.c
> @@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
>                 }
>                 create_info = (struct hci_create_pipe_resp *)skb->data;
>
> +               if (create_info->pipe >= NFC_HCI_MAX_PIPES) {
> +                       status = NFC_HCI_ANY_E_NOK;
> +                       goto exit;
> +               }
> +
>                 /* Save the new created pipe and bind with local gate,
>                  * the description for skb->data[3] is destination gate id
>                  * but since we received this cmd from host controller, we
> @@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
>                 }
>                 delete_info = (struct hci_delete_pipe_noti *)skb->data;
>
> +               if (delete_info->pipe >= NFC_HCI_MAX_PIPES) {
> +                       status = NFC_HCI_ANY_E_NOK;
> +                       goto exit;
> +               }
> +
>                 hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE;
>                 hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST;
>                 break;
> --
> 2.18.0.597.ga71716f1ad-goog
>



-- 
Kees Cook
Pixel Security