lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date:   Wed, 2 Dec 2020 17:27:28 -0800
From:   Jakub Kicinski <kuba@...nel.org>
To:     Martin Schiller <ms@....tdt.de>
Cc:     Dan Carpenter <dan.carpenter@...cle.com>,
        "David S. Miller" <davem@...emloft.net>, linux-x25@...r.kernel.org,
        netdev@...r.kernel.org, Andrew Hendry <andrew.hendry@...il.com>,
        "kiyin尹亮) " <kiyin@...cent.com>,
        security@...nel.org, linux-distros@...openwall.org,
        "huntchen陈阳) " 
        <huntchen@...cent.com>,
        "dannywang王宇) " 
        <dannywang@...cent.com>, kernel-janitors@...r.kernel.org
Subject: Re: [PATCH net v2] net/x25: prevent a couple of overflows

On Wed, 02 Dec 2020 10:27:18 +0100 Martin Schiller wrote:
> On 2020-12-01 16:15, Dan Carpenter wrote:
> > The .x25_addr[] address comes from the user and is not necessarily
> > NUL terminated.  This leads to a couple problems.  The first problem is
> > that the strlen() in x25_bind() can read beyond the end of the buffer.
> > 
> > The second problem is more subtle and could result in memory 
> > corruption.
> > The call tree is:
> >   x25_connect()  
> >   --> x25_write_internal()
> >       --> x25_addr_aton()  
> > 
> > The .x25_addr[] buffers are copied to the "addresses" buffer from
> > x25_write_internal() so it will lead to stack corruption.
> > 
> > Verify that the strings are NUL terminated and return -EINVAL if they
> > are not.
> > 
> > Reported-by: "kiyin(尹亮)" <kiyin@...cent.com>
> > Signed-off-by: Dan Carpenter <dan.carpenter@...cle.com>
> 
> Acked-by: Martin Schiller <ms@....tdt.de>

Applied, thanks!

Powered by blists - more mailing lists