Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1612892

[PATCH 4.9 02/16] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window

Show all headers | View raw

4.9-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Andy Whitcroft <apw@canonical.com>

commit 677e806da4d916052585301785d847c3b3e6186a upstream.

When a new xfrm state is created during an XFRM_MSG_NEWSA call we
validate the user supplied replay_esn to ensure that the size is valid
and to ensure that the replay_window size is within the allocated
buffer.  However later it is possible to update this replay_esn via a
XFRM_MSG_NEWAE call.  There we again validate the size of the supplied
buffer matches the existing state and if so inject the contents.  We do
not at this point check that the replay_window is within the allocated
memory.  This leads to out-of-bounds reads and writes triggered by
netlink packets.  This leads to memory corruption and the potential for
priviledge escalation.

We already attempt to validate the incoming replay information in
xfrm_new_ae() via xfrm_replay_verify_len().  This confirms that the user
is not trying to change the size of the replay state buffer which
includes the replay_esn.  It however does not check the replay_window
remains within that buffer.  Add validation of the contained
replay_window.

CVE-2017-7184
Signed-off-by: Andy Whitcroft <apw@canonical.com>
Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 net/xfrm/xfrm_user.c |    3 +++
 1 file changed, 3 insertions(+)

--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -415,6 +415,9 @@ static inline int xfrm_replay_verify_len
 	if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
 		return -EINVAL;
 
+	if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)
+		return -EINVAL;
+
 	return 0;
 }
 

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.9 00/16] 4.9.20-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 09/16] mips/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 11/16] metag/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 13/16] metag/ptrace: Reject partial NT_METAG_RPIPE writes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 14/16] fscrypt: remove broken support for detecting keyring key revocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 06/16] pinctrl: qcom: Dont clear status bit on irq_unmask Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 10/16] sparc/ptrace: Preserve previous registers for short regset write Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 07/16] c6x/ptrace: Remove useless PTRACE_SETREGSET implementation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 01/16] xfrm: policy: init locks early Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 03/16] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 08/16] h8300/ptrace: Fix incorrect register transfer count Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 12/16] metag/ptrace: Provide default TXSTATUS for short NT_PRSTATUS Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 04/16] KVM: x86: cleanup the page tracking SRCU instance Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:20 +0200
  [PATCH 4.9 02/16] xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:30 +0200
  [PATCH 4.9 05/16] virtio_balloon: init 1st buffer in stats vq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-03-30 12:30 +0200
  Re: [PATCH 4.9 00/16] 4.9.20-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-03-30 21:00 +0200
  Re: [PATCH 4.9 00/16] 4.9.20-stable review Guenter Roeck <linux@roeck-us.net> - 2017-03-31 05:50 +0200

csiph-web