netdev - [PATCH net] net/netlink: fix NETLINK_LIST_MEMBERSHIPS group array length check

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date: Thu, 25 May 2023 11:46:09 -0300
From: Pedro Tammela <pctammela@...atatu.com>
To: netdev@...r.kernel.org
Cc: davem@...emloft.net,
	edumazet@...gle.com,
	kuba@...nel.org,
	pabeni@...hat.com,
	kuniyu@...zon.com,
	dh.herrmann@...il.com,
	jhs@...atatu.com,
	Pedro Tammela <pctammela@...atatu.com>
Subject: [PATCH net] net/netlink: fix NETLINK_LIST_MEMBERSHIPS group array length check

For the socket option 'NETLINK_LIST_MEMBERSHIPS' the length is defined
as the number of u32 required to represent the whole bitset.
User space then usually queries the required size and issues a subsequent
getsockopt call with the correct parameters[1].

The current code has an unit mismatch between 'len' and 'pos', where
'len' is the number of u32 in the passed array while 'pos' is the
number of bytes iterated in the groups bitset.
For netlink groups greater than 32, which from a quick glance
is a rare occasion, the mismatch causes the misreport of groups e.g.
if a rtnl socket is a member of group 34, it's reported as not a member
(all 0s).

[1] https://github.com/systemd/systemd/blob/9c9b9b89151c3e29f3665e306733957ee3979853/src/libsystemd/sd-netlink/netlink-socket.c#L26

Fixes: b42be38b2778 ("netlink: add API to retrieve all group memberships")
Signed-off-by: Pedro Tammela <pctammela@...atatu.com>
---
 net/netlink/af_netlink.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index c87804112d0c..de21ddd5bf9a 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -1765,10 +1765,11 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname,
 		break;
 	case NETLINK_LIST_MEMBERSHIPS: {
 		int pos, idx, shift, err = 0;
+		int blen = len * sizeof(u32);

 		netlink_lock_table();
 		for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) {
-			if (len - pos < sizeof(u32))
+			if (blen - pos < sizeof(u32))
 				break;

 			idx = pos / sizeof(unsigned long);
-- 
2.39.2