netdev - [PATCH net 0/2] net/smc: fix out of bound access in netlink interface

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20210112162122.26832-1-kgraul@linux.ibm.com>
Date:   Tue, 12 Jan 2021 17:21:20 +0100
From:   Karsten Graul <kgraul@...ux.ibm.com>
To:     David Miller <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>
Cc:     Heiko Carstens <hca@...ux.ibm.com>,
        Stefan Raspl <raspl@...ux.ibm.com>, netdev@...r.kernel.org,
        linux-s390@...r.kernel.org
Subject: [PATCH net 0/2] net/smc: fix out of bound access in netlink interface

Please apply the following patch for smc to netdev's net tree.

Both patches fix possible out-of-bounds reads. The original code expected
that snprintf() reads len-1 bytes from source and appends the terminating
null, but actually snprintf() first copies len bytes and finally overwrites
the last byte with a null.
Fix this by using memcpy() and terminating the string afterwards.

Guvenc Gulce (1):
  net/smc: use memcpy instead of snprintf to avoid out of bounds read

Jakub Kicinski (1):
  smc: fix out of bound access in smc_nl_get_sys_info()

 net/smc/smc_core.c | 20 +++++++++++++-------
 net/smc/smc_ib.c   |  6 +++---
 net/smc/smc_ism.c  |  3 ++-
 3 files changed, 18 insertions(+), 11 deletions(-)

-- 
2.17.1