netdev - Re: [PATCH net] seg6: Fix validation of nexthop addresses

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <229ed61e-b9cc-4c35-ad40-ff14391a74aa@kernel.org>
Date: Wed, 4 Jun 2025 09:56:52 -0600
From: David Ahern <dsahern@...nel.org>
To: Ido Schimmel <idosch@...dia.com>, netdev@...r.kernel.org
Cc: davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
 edumazet@...gle.com, andrea.mayer@...roma2.it, horms@...nel.org,
 david.lebrun@...ouvain.be, petrm@...dia.com
Subject: Re: [PATCH net] seg6: Fix validation of nexthop addresses

On 6/4/25 5:32 AM, Ido Schimmel wrote:
> The kernel currently validates that the length of the provided nexthop
> address does not exceed the specified length. This can lead to the
> kernel reading uninitialized memory if user space provided a shorter
> length than the specified one.
> 
> Fix by validating that the provided length exactly matches the specified
> one.
> 
> Fixes: d1df6fd8a1d2 ("ipv6: sr: define core operations for seg6local lightweight tunnel")
> Reviewed-by: Petr Machata <petrm@...dia.com>
> Signed-off-by: Ido Schimmel <idosch@...dia.com>
> ---
> Noticed this while extending End.X behavior with oif support.
> ---
>  net/ipv6/seg6_local.c | 6 ++----
>  1 file changed, 2 insertions(+), 4 deletions(-)
> 


Reviewed-by: David Ahern <dsahern@...nel.org>