netdev - A missing check bug and an inconsistent check bug

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAA-qYXgrcXsgHMoDyTR74bryDsofzPajTfT6WZHGH-vaDixDwA@mail.gmail.com>
Date:   Tue, 15 Feb 2022 20:30:02 +0800
From:   Jinmeng Zhou <jjjinmeng.zhou@...il.com>
To:     isdn@...ux-pingi.de, Jakub Kicinski <kuba@...nel.org>,
        davem@...emloft.net
Cc:     netdev@...r.kernel.org, shenwenbosmile@...il.com
Subject: A missing check bug and an inconsistent check bug

Dear maintainers,

Hi, our tool finds a missing check bug(v4.18.5),
and an inconsistent check bug (v5.10.7) using static analysis.
We are looking forward to having more experts' eyes on this. Thank you!

Before calling sk_alloc() with SOCK_RAW type,
there should be a permission check, ns_capable(ns,CAP_NET_RAW).

In kernel v4.18.5, there is no check in base_sock_create().
However, v5.10.7 adds a check.  (1) So is it a missing check bug?

drivers/isdn/mISDN/socket.c (v4.18.5)
static int
base_sock_create(struct net *net, struct socket *sock, int protocol, int kern)
{
struct sock *sk;

if (sock->type != SOCK_RAW)
return -ESOCKTNOSUPPORT;

sk = sk_alloc(net, PF_ISDN, GFP_KERNEL, &mISDN_proto, kern);
if (!sk)
return -ENOMEM;
...
}

In kernel v5.10.7, a check is added in the same function,
base_sock_create(), which is not ns-aware. (2) Should it use ns_capable()?

drivers/isdn/mISDN/socket.c (v5.10.7)
static int
base_sock_create(struct net *net, struct socket *sock, int protocol, int kern)
{
struct sock *sk;

if (sock->type != SOCK_RAW)
return -ESOCKTNOSUPPORT;
if (!capable(CAP_NET_RAW))
return -EPERM;

sk = sk_alloc(net, PF_ISDN, GFP_KERNEL, &mISDN_proto, kern);
if (!sk)
return -ENOMEM;
...
}

Thanks again!

Best regards,
Jinmeng Zhou