netdev - Re: [PATCH iproute2] nstat: Fix NULL Pointer Dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250405083434.1c5b329e@hermes.local>
Date: Sat, 5 Apr 2025 08:34:34 -0700
From: Stephen Hemminger <stephen@...workplumber.org>
To: "李子奥" <23110240084@...udan.edu.cn>
Cc: "netdev" <netdev@...r.kernel.org>
Subject: Re: [PATCH iproute2] nstat: Fix NULL Pointer Dereference

On Sat, 5 Apr 2025 17:42:20 +0800
"李子奥" <23110240084@...udan.edu.cn> wrote:

> The vulnerability happens in load_ugly_table(), misc/nstat.c, in the latest version of iproute2.
> The vulnerability can be triggered by:
> 1. db is set to NULL at struct nstat_ent *db = NULL;
> 2. n is set to NULL at n = db;
> 3. NULL dereference of variable n happens at sscanf(p+1, "%llu", &n->val) != 1
> 
> Subject: [PATCH] Fix Null Dereference when no entries are specified
> 
> Signed-off-by: Ziao Li <leeziao0331@...il.com>
> ---
> misc/nstat.c | 4 ++++
> 1 file changed, 4 insertions(+)
> 
> diff --git a/misc/nstat.c b/misc/nstat.c
> index fce3e9c1..b2e19bde 100644
> --- a/misc/nstat.c
> +++ b/misc/nstat.c
> @@ -218,6 +218,10 @@ static void load_ugly_table(FILE *fp)
>            p = next;
>        }
>        n = db;
> +       if (n == NULL) {
> +           fprintf(stderr, "Error: Invalid input – line has ':' but no entries. Add values after ':'.\n");
> +           exit(-2);
> +       }
>        nread = getline(&buf, &buflen, fp);
>        if (nread == -1) {
>            fprintf(stderr, "%s:%d: error parsing history file\n",
> --
> 2.34.1

Better, but your mailer is still confusing the patch.
You may have to resort to using an attachment.

Also, iproute2 uses kernel coding style and indentation is done with
tabs not spaces.

If this is all too hard for you to fix, I can just do it manually.