lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20230525144609.503744-1-pctammela@mojatatu.com> Date: Thu, 25 May 2023 11:46:09 -0300 From: Pedro Tammela <pctammela@...atatu.com> To: netdev@...r.kernel.org Cc: davem@...emloft.net, edumazet@...gle.com, kuba@...nel.org, pabeni@...hat.com, kuniyu@...zon.com, dh.herrmann@...il.com, jhs@...atatu.com, Pedro Tammela <pctammela@...atatu.com> Subject: [PATCH net] net/netlink: fix NETLINK_LIST_MEMBERSHIPS group array length check For the socket option 'NETLINK_LIST_MEMBERSHIPS' the length is defined as the number of u32 required to represent the whole bitset. User space then usually queries the required size and issues a subsequent getsockopt call with the correct parameters[1]. The current code has an unit mismatch between 'len' and 'pos', where 'len' is the number of u32 in the passed array while 'pos' is the number of bytes iterated in the groups bitset. For netlink groups greater than 32, which from a quick glance is a rare occasion, the mismatch causes the misreport of groups e.g. if a rtnl socket is a member of group 34, it's reported as not a member (all 0s). [1] https://github.com/systemd/systemd/blob/9c9b9b89151c3e29f3665e306733957ee3979853/src/libsystemd/sd-netlink/netlink-socket.c#L26 Fixes: b42be38b2778 ("netlink: add API to retrieve all group memberships") Signed-off-by: Pedro Tammela <pctammela@...atatu.com> --- net/netlink/af_netlink.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c index c87804112d0c..de21ddd5bf9a 100644 --- a/net/netlink/af_netlink.c +++ b/net/netlink/af_netlink.c @@ -1765,10 +1765,11 @@ static int netlink_getsockopt(struct socket *sock, int level, int optname, break; case NETLINK_LIST_MEMBERSHIPS: { int pos, idx, shift, err = 0; + int blen = len * sizeof(u32); netlink_lock_table(); for (pos = 0; pos * 8 < nlk->ngroups; pos += sizeof(u32)) { - if (len - pos < sizeof(u32)) + if (blen - pos < sizeof(u32)) break; idx = pos / sizeof(unsigned long); -- 2.39.2
Powered by blists - more mailing lists