lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Wed, 2 Dec 2020 17:27:28 -0800 From: Jakub Kicinski <kuba@...nel.org> To: Martin Schiller <ms@....tdt.de> Cc: Dan Carpenter <dan.carpenter@...cle.com>, "David S. Miller" <davem@...emloft.net>, linux-x25@...r.kernel.org, netdev@...r.kernel.org, Andrew Hendry <andrew.hendry@...il.com>, "kiyin尹亮) " <kiyin@...cent.com>, security@...nel.org, linux-distros@...openwall.org, "huntchen陈阳) " <huntchen@...cent.com>, "dannywang王宇) " <dannywang@...cent.com>, kernel-janitors@...r.kernel.org Subject: Re: [PATCH net v2] net/x25: prevent a couple of overflows On Wed, 02 Dec 2020 10:27:18 +0100 Martin Schiller wrote: > On 2020-12-01 16:15, Dan Carpenter wrote: > > The .x25_addr[] address comes from the user and is not necessarily > > NUL terminated. This leads to a couple problems. The first problem is > > that the strlen() in x25_bind() can read beyond the end of the buffer. > > > > The second problem is more subtle and could result in memory > > corruption. > > The call tree is: > > x25_connect() > > --> x25_write_internal() > > --> x25_addr_aton() > > > > The .x25_addr[] buffers are copied to the "addresses" buffer from > > x25_write_internal() so it will lead to stack corruption. > > > > Verify that the strings are NUL terminated and return -EINVAL if they > > are not. > > > > Reported-by: "kiyin(尹亮)" <kiyin@...cent.com> > > Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com> > > Acked-by: Martin Schiller <ms@....tdt.de> Applied, thanks!
Powered by blists - more mailing lists