netdev - Re: [PATCH v3] can: gw: ensure DLC boundaries after CAN frame modification

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <d07efb4f-462f-3edb-04d9-5ab632b972cd@pengutronix.de>
Date:   Sat, 5 Jan 2019 11:56:16 +0100
From:   Marc Kleine-Budde <mkl@...gutronix.de>
To:     David Miller <davem@...emloft.net>
Cc:     linux-can@...r.kernel.org, kernel@...gutronix.de,
        netdev@...r.kernel.org, socketcan@...tkopp.net,
        ieatmuttonchuan@...il.com, meissner@...e.de, mkubecek@...e.cz,
        stable@...r.kernel.org
Subject: Re: [PATCH v3] can: gw: ensure DLC boundaries after CAN frame
 modification

On 1/4/19 10:41 PM, David Miller wrote:
> From: Marc Kleine-Budde <mkl@...gutronix.de>
> Date: Fri,  4 Jan 2019 15:55:26 +0100
> 
>> From: Oliver Hartkopp <socketcan@...tkopp.net>
>>
>> Muyu Yu provided a POC where user root with CAP_NET_ADMIN can create a CAN
>> frame modification rule that makes the data length code a higher value than
>> the available CAN frame data size. In combination with a configured checksum
>> calculation where the result is stored relatively to the end of the data
>> (e.g. cgw_csum_xor_rel) the tail of the skb (e.g. frag_list pointer in
>> skb_shared_info) can be rewritten which finally can cause a system crash.
>>
>> Michael Kubecek suggested to drop frames that have a DLC exceeding the
>> available space after the modification process and provided a patch that can
>> handle CAN FD frames too. Within this patch we also limit the length for the
>> checksum calculations to the maximum of Classic CAN data length (8).
>>
>> CAN frames that are dropped by these additional checks are counted with the
>> CGW_DELETED counter which indicates misconfigurations in can-gw rules.
>>
>> This fixes CVE-2019-3701.
>>
>> Reported-by: Muyu Yu <ieatmuttonchuan@...il.com>
>> Reported-by: Marcus Meissner <meissner@...e.de>
>> Suggested-by: Michal Kubecek <mkubecek@...e.cz>
>> Tested-by: Muyu Yu <ieatmuttonchuan@...il.com>
>> Tested-by: Oliver Hartkopp <socketcan@...tkopp.net>
>> Signed-off-by: Oliver Hartkopp <socketcan@...tkopp.net>
>> Cc: linux-stable <stable@...r.kernel.org> # >= v3.2
>> Signed-off-by: Marc Kleine-Budde <mkl@...gutronix.de>
> 
> Marc, do you want me to apply this directly to my net tree?

No, I'll send a pull request.

Thanks,
Marc

-- 
Pengutronix e.K.                  | Marc Kleine-Budde           |
Industrial Linux Solutions        | Phone: +49-231-2826-924     |
Vertretung West/Dortmund          | Fax:   +49-5121-206917-5555 |
Amtsgericht Hildesheim, HRA 2686  | http://www.pengutronix.de   |



Download attachment "signature.asc" of type "application/pgp-signature" (489 bytes)