netdev - Re: [PATCH net] sctp: fix possibly using a bad saddr with a given dst

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20200329.220242.1383520985415551854.davem@davemloft.net>
Date:   Sun, 29 Mar 2020 22:02:42 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     marcelo.leitner@...il.com
Cc:     netdev@...r.kernel.org, linux-sctp@...r.kernel.org,
        nhorman@...driver.com, lucien.xin@...il.com,
        meng.a.jin@...ia-sbell.com
Subject: Re: [PATCH net] sctp: fix possibly using a bad saddr with a given
 dst

From: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
Date: Thu, 26 Mar 2020 20:47:46 -0300

> Under certain circumstances, depending on the order of addresses on the
> interfaces, it could be that sctp_v[46]_get_dst() would return a dst
> with a mismatched struct flowi.
> 
> For example, if when walking through the bind addresses and the first
> one is not a match, it saves the dst as a fallback (added in
> 410f03831c07), but not the flowi. Then if the next one is also not a
> match, the previous dst will be returned but with the flowi information
> for the 2nd address, which is wrong.
> 
> The fix is to use a locally stored flowi that can be used for such
> attempts, and copy it to the parameter only in case it is a possible
> match, together with the corresponding dst entry.
> 
> The patch updates IPv6 code mostly just to be in sync. Even though the issue
> is also present there, it fallback is not expected to work with IPv6.
> 
> Fixes: 410f03831c07 ("sctp: add routing output fallback")
> Reported-by: Jin Meng <meng.a.jin@...ia-sbell.com>
> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>

Applied and queued up for -stable.