netdev - Re: [PATCH v3] can: gw: ensure DLC boundaries after CAN frame modification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190104.134126.1987487762349795104.davem@davemloft.net>
Date:   Fri, 04 Jan 2019 13:41:26 -0800 (PST)
From:   David Miller <davem@...emloft.net>
To:     mkl@...gutronix.de
Cc:     linux-can@...r.kernel.org, kernel@...gutronix.de,
        netdev@...r.kernel.org, socketcan@...tkopp.net,
        ieatmuttonchuan@...il.com, meissner@...e.de, mkubecek@...e.cz,
        stable@...r.kernel.org
Subject: Re: [PATCH v3] can: gw: ensure DLC boundaries after CAN frame
 modification

From: Marc Kleine-Budde <mkl@...gutronix.de>
Date: Fri,  4 Jan 2019 15:55:26 +0100

> From: Oliver Hartkopp <socketcan@...tkopp.net>
> 
> Muyu Yu provided a POC where user root with CAP_NET_ADMIN can create a CAN
> frame modification rule that makes the data length code a higher value than
> the available CAN frame data size. In combination with a configured checksum
> calculation where the result is stored relatively to the end of the data
> (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in
> skb_shared_info) can be rewritten which finally can cause a system crash.
> 
> Michael Kubecek suggested to drop frames that have a DLC exceeding the
> available space after the modification process and provided a patch that can
> handle CAN FD frames too. Within this patch we also limit the length for the
> checksum calculations to the maximum of Classic CAN data length (8).
> 
> CAN frames that are dropped by these additional checks are counted with the
> CGW_DELETED counter which indicates misconfigurations in can-gw rules.
> 
> This fixes CVE-2019-3701.
> 
> Reported-by: Muyu Yu <ieatmuttonchuan@...il.com>
> Reported-by: Marcus Meissner <meissner@...e.de>
> Suggested-by: Michal Kubecek <mkubecek@...e.cz>
> Tested-by: Muyu Yu <ieatmuttonchuan@...il.com>
> Tested-by: Oliver Hartkopp <socketcan@...tkopp.net>
> Signed-off-by: Oliver Hartkopp <socketcan@...tkopp.net>
> Cc: linux-stable <stable@...r.kernel.org> # >= v3.2
> Signed-off-by: Marc Kleine-Budde <mkl@...gutronix.de>

Marc, do you want me to apply this directly to my net tree?

Thanks.