lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 02 Apr 2019 13:23:06 -0700 (PDT)
From:   David Miller <>
Subject: Re: [PATCH] net: socket: Always initialize family field at

From: Tetsuo Handa <>
Date: Mon,  1 Apr 2019 23:19:22 +0900

> syzbot is reporting uninitialized value at rds_connect [1] and
> rds_bind [2]. This is because syzbot is passing ulen == 0 whereas
> these functions expects that it is safe to access sockaddr->family field
> in order to determine minimal ulen size for validation. I noticed that
> the same problem also exists in tomoyo_check_inet_address() function.
> Although the right fix might be to scatter around
>   if (ulen < sizeof(__kernel_sa_family_t))
>     return 0;
> if the function wants to become no-op when the address is too short or
>   if (ulen < sizeof(__kernel_sa_family_t))
>     return -EINVAL;
> if the function wants to reject when the address is too short, we can
> avoid duplication (at e.g. LSM layer and protocol layer) if we make sure
> that sockaddr->family field is always accessible.
> [1]
> [2]
> Reported-by: syzbot <>
> Reported-by: syzbot <>
> Signed-off-by: Tetsuo Handa <>

I do not think at all that it is wise to be OK with the socket address
interpreation code ignoring the length.

Please fix RDS and other protocols to examine the length properly

Thank you.

Powered by blists - more mailing lists