netdev - Re: [PATCH net-next 1/2] nexthop: Fix out-of-bounds access during attribute validation

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <877ci8lq9m.fsf@nvidia.com>
Date: Mon, 11 Mar 2024 16:52:23 +0100
From: Petr Machata <petrm@...dia.com>
To: Jakub Kicinski <kuba@...nel.org>
CC: Ido Schimmel <idosch@...dia.com>, David Ahern <dsahern@...nel.org>,
	<netdev@...r.kernel.org>, <davem@...emloft.net>, <pabeni@...hat.com>,
	<edumazet@...gle.com>, <petrm@...dia.com>
Subject: Re: [PATCH net-next 1/2] nexthop: Fix out-of-bounds access during
 attribute validation


Jakub Kicinski <kuba@...nel.org> writes:

> On Sun, 10 Mar 2024 23:41:53 +0200 Ido Schimmel wrote:
>> > 'tb' on the stack only needs to be ARRAY_SIZE as well; that's the
>> > benefit of the approach - only declare what you need.  
>> 
>> The reasoning for that is explained in Petr's commit message:
>> 
>> "
>>     - To allow querying for presence of the attribute, have all the attribute
>>       arrays sized to NHA_MAX, regardless of what is permitted by policy, and
>>       pass the corresponding value to nlmsg_parse() as well.
>> "
>> 
>> IOW, with resizing 'tb' to ARRAY_SIZE:
>> 
>> rtm_del_nexthop
>>     nh_valid_get_del_req
>>         if (tb[NHA_OP_FLAGS]) -> BOOM
>
> v2 coming, right? Please repost as soon as possible. v1 crashes AFAICT
> because tb is not 0-initialized so tb[NHA_OP_FLAGS] reads garbage.

Ido will send v2 later today.