netdev - [Linux-kernel-mentees] [PATCH net] ethtool: strset: Fix out of bound read in strset_parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun, 11 Oct 2020 02:39:29 +0530
From:   Anmol Karn <anmol.karan123@...il.com>
To:     davem@...emloft.net, kuba@...nel.org
Cc:     mkubecek@...e.cz, andrew@...n.ch, f.fainelli@...il.com,
        dan.carpenter@...cle.com, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org,
        linux-kernel-mentees@...ts.linuxfoundation.org,
        syzkaller-bugs@...glegroups.com, anmol.karan123@...il.com,
        syzbot+9d1389df89299fa368dc@...kaller.appspotmail.com
Subject: [Linux-kernel-mentees] [PATCH net] ethtool: strset: Fix out of bound read in strset_parse_request()

Flag ``ETHTOOL_A_STRSET_COUNTS_ONLY`` tells the kernel to only return the string 
counts of the sets, but, when req_info->counts_only tries to read the 
tb[ETHTOOL_A_STRSET_COUNTS_ONLY] it gets out of bound. 

- net/ethtool/strset.c
The bug seems to trigger in this line:

req_info->counts_only = tb[ETHTOOL_A_STRSET_COUNTS_ONLY];

Fix it by NULL checking for req_info->counts_only while 
reading from tb[ETHTOOL_A_STRSET_COUNTS_ONLY].

Reported-by: syzbot+9d1389df89299fa368dc@...kaller.appspotmail.com 
Link: https://syzkaller.appspot.com/bug?id=730deff8fe9954a5e317924d9acff98d9c64a770 
Signed-off-by: Anmol Karn <anmol.karan123@...il.com>
---
When I tried to reduce the index of tb[] by 1, the crash reproducer was not working anymore,
hence it's probably reading from tb[ETHTOOL_A_STRSET_STRINGSETS], but this won't give the 
strset 'count' and hence is not a plausible fix. But checking for the req_info->counts_only 
seems legit.

If I have missed something please let me know, and I will work towards fixing it in next version.

 net/ethtool/strset.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/ethtool/strset.c b/net/ethtool/strset.c
index 82707b662fe4..20a7b36698f3 100644
--- a/net/ethtool/strset.c
+++ b/net/ethtool/strset.c
@@ -174,7 +174,8 @@ static int strset_parse_request(struct ethnl_req_info *req_base,
 	if (ret < 0)
 		return ret;
 
-	req_info->counts_only = tb[ETHTOOL_A_STRSET_COUNTS_ONLY];
+	if (req_info->counts_only)
+		req_info->counts_only = tb[ETHTOOL_A_STRSET_COUNTS_ONLY];
 	nla_for_each_nested(attr, nest, rem) {
 		u32 id;
 
-- 
2.28.0