netdev - [PATCH net-next] sctp: fix slab-out-of-bounds in SCTP_DELAYED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 22 Jul 2020 17:38:58 -0300
From:   Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
To:     netdev@...r.kernel.org
Cc:     Neil Horman <nhorman@...driver.com>, Christoph Hellwig <hch@....de>
Subject: [PATCH net-next] sctp: fix slab-out-of-bounds in SCTP_DELAYED_SACK processing

This sockopt accepts two kinds of parameters, using struct
sctp_sack_info and struct sctp_assoc_value. The mentioned commit didn't
notice an implicit cast from the smaller (latter) struct to the bigger
one (former) when copying the data from the user space, which now leads
to an attempt to write beyond the buffer (because it assumes the storing
buffer is bigger than the parameter itself).

Fix it by giving it a special buffer if the smaller struct is used by
the application.

Fixes: ebb25defdc17 ("sctp: pass a kernel pointer to sctp_setsockopt_delayed_ack")
Reported-by: syzbot+0e4699d000d8b874d8dc@...kaller.appspotmail.com
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@...il.com>
---
 net/sctp/socket.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index 9a767f35971865f46b39131fc8d96d8c3c2aa1a8..b71c36af7687247b4fc9e160219b76f5c41b2fe2 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -2756,6 +2756,7 @@ static int sctp_setsockopt_delayed_ack(struct sock *sk,
 {
 	struct sctp_sock *sp = sctp_sk(sk);
 	struct sctp_association *asoc;
+	struct sctp_sack_info _params;
 
 	if (optlen == sizeof(struct sctp_sack_info)) {
 		if (params->sack_delay == 0 && params->sack_freq == 0)
@@ -2767,7 +2768,9 @@ static int sctp_setsockopt_delayed_ack(struct sock *sk,
 				    "Use struct sctp_sack_info instead\n",
 				    current->comm, task_pid_nr(current));
 
-		if (params->sack_delay == 0)
+		memcpy(&_params, params, sizeof(struct sctp_assoc_value));
+		params = &_params;
+		if (((struct sctp_assoc_value *)params)->assoc_value == 0)
 			params->sack_freq = 1;
 		else
 			params->sack_freq = 0;
-- 
2.25.4