netdev - Re: [PATCH v2 net-next] sctp: fix slab-out-of-bounds in SCTP_DELAYED

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <20200724.164952.472536620054081569.davem@davemloft.net>
Date:   Fri, 24 Jul 2020 16:49:52 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     hch@....de
Cc:     marcelo.leitner@...il.com, nhorman@...driver.com,
        linux-sctp@...r.kernel.org, netdev@...r.kernel.org,
        syzbot+0e4699d000d8b874d8dc@...kaller.appspotmail.com
Subject: Re: [PATCH v2 net-next] sctp: fix slab-out-of-bounds in
 SCTP_DELAYED_SACK processing

From: Christoph Hellwig <hch@....de>
Date: Fri, 24 Jul 2020 08:48:55 +0200

> This sockopt accepts two kinds of parameters, using struct
> sctp_sack_info and struct sctp_assoc_value. The mentioned commit didn't
> notice an implicit cast from the smaller (latter) struct to the bigger
> one (former) when copying the data from the user space, which now leads
> to an attempt to write beyond the buffer (because it assumes the storing
> buffer is bigger than the parameter itself).
> 
> Fix it by allocating a sctp_sack_info on stack and filling it out based
> on the small struct for the compat case.
> 
> Changelog stole from an earlier patch from Marcelo Ricardo Leitner.
> 
> Fixes: ebb25defdc17 ("sctp: pass a kernel pointer to sctp_setsockopt_delayed_ack")
> Reported-by: syzbot+0e4699d000d8b874d8dc@...kaller.appspotmail.com
> Signed-off-by: Christoph Hellwig <hch@....de>

Applied, thanks.