netdev - Re: [PATCH net v2] net/x25: prevent a couple of overflows

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Wed, 2 Dec 2020 17:27:28 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Martin Schiller <ms@....tdt.de>
Cc:     Dan Carpenter <dan.carpenter@...cle.com>,
        "David S. Miller" <davem@...emloft.net>, linux-x25@...r.kernel.org,
        netdev@...r.kernel.org, Andrew Hendry <andrew.hendry@...il.com>,
        "kiyin尹亮) " <kiyin@...cent.com>,
        security@...nel.org, linux-distros@...openwall.org,
        "huntchen陈阳) " 
        <huntchen@...cent.com>,
        "dannywang王宇) " 
        <dannywang@...cent.com>, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH net v2] net/x25: prevent a couple of overflows

On Wed, 02 Dec 2020 10:27:18 +0100 Martin Schiller wrote:
> On 2020-12-01 16:15, Dan Carpenter wrote:
> > The .x25_addr[] address comes from the user and is not necessarily
> > NUL terminated.  This leads to a couple problems.  The first problem is
> > that the strlen() in x25_bind() can read beyond the end of the buffer.
> > 
> > The second problem is more subtle and could result in memory 
> > corruption.
> > The call tree is:
> >   x25_connect()  
> >   --> x25_write_internal()
> >       --> x25_addr_aton()  
> > 
> > The .x25_addr[] buffers are copied to the "addresses" buffer from
> > x25_write_internal() so it will lead to stack corruption.
> > 
> > Verify that the strings are NUL terminated and return -EINVAL if they
> > are not.
> > 
> > Reported-by: "kiyin(尹亮)" <kiyin@...cent.com>
> > Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> 
> Acked-by: Martin Schiller <ms@....tdt.de>

Applied, thanks!