netdev - Re: [PATCH net] net: rose: fix invalid array index in rose_kill_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAJxTgFzwzAnJkRt9Y0nF6ByG1vKRs81JQ-oUq4AL5zWv40eihg@mail.gmail.com>
Date: Mon, 22 Dec 2025 16:27:23 -0500
From: Ritvik Tanksalkar <ritviktanksalkar@...il.com>
To: kuba@...nel.org, pabeni@...hat.com
Cc: davem@...emloft.net, edumazet@...gle.com, horms@...nel.org, 
	netdev@...r.kernel.org, linux-hams@...r.kernel.org, 
	Pwnverse <stanksal@...due.edu>, Fatma Alwasmi <falwasmi@...due.edu>
Subject: Re: [PATCH net] net: rose: fix invalid array index in rose_kill_by_device()

Hello,

Apologies for another ping. I forgot to attach the POC (results in crash
under CAP_NET_ADMIN).

Warm Regards,
Ritvik Tanksalkar

On Mon, Dec 22, 2025 at 4:22 PM Sai Ritvik Tanksalkar <
ritviktanksalkar@...il.com> wrote:

> From: Pwnverse <stanksal@...due.edu>
>
> rose_kill_by_device() collects sockets into a local array[] and then
> iterates over them to disconnect sockets bound to a device being brought
> down.
>
> The loop mistakenly indexes array[cnt] instead of array[i]. For cnt <
> ARRAY_SIZE(array), this reads an uninitialized entry; for cnt ==
> ARRAY_SIZE(array), it is an out-of-bounds read. Either case can lead to
> an invalid socket pointer dereference and also leaks references taken
> via sock_hold().
>
> Fix the index to use i.
>
> Fixes: 64b8bc7d5f143 ("net/rose: fix races in rose_kill_by_device()")
> Co-developed-by: Fatma Alwasmi <falwasmi@...due.edu>
> Signed-off-by: Fatma Alwasmi <falwasmi@...due.edu>
> Signed-off-by: Pwnverse <stanksal@...due.edu>
> ---
>  net/rose/af_rose.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/rose/af_rose.c b/net/rose/af_rose.c
> index fd67494f2815..c0f5a515a8ce 100644
> --- a/net/rose/af_rose.c
> +++ b/net/rose/af_rose.c
> @@ -205,7 +205,7 @@ static void rose_kill_by_device(struct net_device *dev)
>         spin_unlock_bh(&rose_list_lock);
>
>         for (i = 0; i < cnt; i++) {
> -               sk = array[cnt];
> +               sk = array[i];
>                 rose = rose_sk(sk);
>                 lock_sock(sk);
>                 spin_lock_bh(&rose_list_lock);
> --
> 2.43.0
>
>

Content of type "text/html" skipped

Download attachment "net_rose_poc.c" of type "application/octet-stream" (5882 bytes)