lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <1fca256d-fbce-4da9-471f-14573be4ea21@huawei.com> Date: Sat, 4 May 2019 15:26:25 +0800 From: Zhiqiang Liu <liuzhiqiang26@...wei.com> To: <stephen@...workplumber.org>, <liuhangbin@...il.com>, <kuznet@....inr.ac.ru> CC: <nicolas.dichtel@...nd.com>, <phil@....cc>, "wangxiaogang (F)" <wangxiaogang3@...wei.com>, Mingfangsen <mingfangsen@...wei.com>, "Zhoukang (A)" <zhoukang7@...wei.com>, <kouhuiying@...wei.com>, <netdev@...r.kernel.org> Subject: [PATCH iproute2 v3] ipnetns: use-after-free problem in get_netnsid_from_name func From: Zhiqiang Liu <liuzhiqiang26@...wei.com> Follow the following steps: # ip netns add net1 # export MALLOC_MMAP_THRESHOLD_=0 # ip netns list then Segmentation fault (core dumped) will occur. In get_netnsid_from_name func, answer is freed before rta_getattr_u32(tb[NETNSA_NSID]), where tb[] refers to answer`s content. If we set MALLOC_MMAP_THRESHOLD_=0, mmap will be adoped to malloc memory, which will be freed immediately after calling free func. So reading tb[NETNSA_NSID] will access the released memory after free(answer). Here, we will call get_netnsid_from_name(tb[NETNSA_NSID]) before free(answer). Fixes: 86bf43c7c2f ("lib/libnetlink: update rtnl_talk to support malloc buff at run time") Reported-by: Huiying Kou <kouhuiying@...wei.com> Signed-off-by: Zhiqiang Liu <liuzhiqiang26@...wei.com> Acked-by: Phil Sutter <phil@....cc> --- v2->v3: add Cc:netdev@...r.kernel.org suggested by Phil Sutter v1->v2: correct commit log ip/ipnetns.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/ip/ipnetns.c b/ip/ipnetns.c index 430d884..d72be95 100644 --- a/ip/ipnetns.c +++ b/ip/ipnetns.c @@ -107,7 +107,7 @@ int get_netnsid_from_name(const char *name) struct nlmsghdr *answer; struct rtattr *tb[NETNSA_MAX + 1]; struct rtgenmsg *rthdr; - int len, fd; + int len, fd, ret = -1; netns_nsid_socket_init(); @@ -134,8 +134,9 @@ int get_netnsid_from_name(const char *name) parse_rtattr(tb, NETNSA_MAX, NETNS_RTA(rthdr), len); if (tb[NETNSA_NSID]) { + ret = rta_getattr_u32(tb[NETNSA_NSID]); free(answer); - return rta_getattr_u32(tb[NETNSA_NSID]); + return ret; } err_out: -- 1.8.3.1
Powered by blists - more mailing lists