netdev - Re: [net-next v1 1/2] tipc: fix use-after-free in tipc_sk_filter

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20190321.095712.792633629065636362.davem@davemloft.net>
Date:   Thu, 21 Mar 2019 09:57:12 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     hoang.h.le@...tech.com.au
Cc:     jon.maloy@...csson.com, maloy@...jonn.com, ying.xue@...driver.com,
        tipc-discussion@...ts.sourceforge.net, netdev@...r.kernel.org
Subject: Re: [net-next v1 1/2] tipc: fix use-after-free in
 tipc_sk_filter_rcv

From: Hoang Le <hoang.h.le@...tech.com.au>
Date: Thu, 21 Mar 2019 17:25:17 +0700

> skb free-ed in:
>   1/ condition 1: tipc_sk_filter_rcv -> tipc_sk_proto_rcv
>   2/ condition 2: tipc_sk_filter_rcv -> tipc_group_filter_msg
> This leads to a "use-after-free" access in the next condition.
> 
> We fix this by intializing the variable at declaration, then it is safe
> to check this variable to continue processing if condition matches.
> 
> syzbot report:
 ...
> Reported-by: syzbot+e863893591cc7a622e40@...kaller.appspotmail.com
> Fixes: c55c8eda ("tipc: smooth change between replicast and broadcast")
> Acked-by: Jon Maloy <jon.maloy@...csson.com>
> Signed-off-by: Hoang Le <hoang.h.le@...tech.com.au>

Applied.