[PATCH 3.2 002/106] af_key: Fix slab-out-of-bounds in pfkey_compile_policy.

Path	csiph.com!goblin2!goblin1!goblin.stu.neva.ru!feeders.as203319.net!feeder01.as203319.net!aioe.org!bofh.it!news.nic.it!robomod
From	Ben Hutchings <ben@decadent.org.uk>
Newsgroups	linux.kernel
Subject	[PATCH 3.2 002/106] af_key: Fix slab-out-of-bounds in pfkey_compile_policy.
Date	Sun, 10 Sep 2017 01:50:01 +0200
Message-ID	<unXFD-43x-17@gated-at.bofh.it> (permalink)
References	<unWqe-3ep-23@gated-at.bofh.it>
Content-Type	text/plain; charset="UTF-8"
Content-Disposition	inline
Content-Transfer-Encoding	8bit
MIME-Version	1.0
X-Mailer	LinuxStableQueue (scripts by bwh)
X-Sa-Exim-Connect-IP	2a02:8011:400e:2:6f00:88c8:c921:d332
X-Sa-Exim-Mail-From	ben@decadent.org.uk
X-Sa-Exim-Scanned	No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false
Sender	robomod@news.nic.it
List-ID	<linux-kernel.vger.kernel.org>
X-Mailing-List	linux-kernel@vger.kernel.org
Approved	robomod@news.nic.it
Lines	33
Organization	linux.* mail to news gateway
X-Original-Cc	akpm@linux-foundation.org, "Steffen Klassert" <steffen.klassert@secunet.com>, "Andrey Konovalov" <andreyknvl@google.com>
X-Original-Date	Sat, 09 Sep 2017 22:47:39 +0100
X-Original-Message-ID	<lsq.1504993659.104713460@decadent.org.uk>
X-Original-References	<lsq.1504993659.376385113@decadent.org.uk>
X-Original-Sender	linux-kernel-owner@vger.kernel.org
Xref	csiph.com linux.kernel:1729877

Show key headers only | View raw

3.2.93-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Steffen Klassert <steffen.klassert@secunet.com>

commit d90c902449a7561f1b1d58ba5a0d11728ce8b0b2 upstream.

The sadb_x_sec_len is stored in the unit 'byte divided by eight'.
So we have to multiply this value by eight before we can do
size checks. Otherwise we may get a slab-out-of-bounds when
we memcpy the user sec_ctx.

Fixes: df71837d502 ("[LSM-IPSec]: Security association restriction.")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/key/af_key.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3230,7 +3230,7 @@ static struct xfrm_policy *pfkey_compile
 		p += pol->sadb_x_policy_len*8;
 		sec_ctx = (struct sadb_x_sec_ctx *)p;
 		if (len < pol->sadb_x_policy_len*8 +
-		    sec_ctx->sadb_x_sec_len) {
+		    sec_ctx->sadb_x_sec_len*8) {
 			*dir = -EINVAL;
 			goto out;
 		}

Thread

[PATCH 3.2 000/106] 3.2.93-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:00 +0200
  [PATCH 3.2 017/106] USB: gadget: dummy_hcd: fix hub-descriptor  removable fields Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:00 +0200
  [PATCH 3.2 090/106] rtnetlink: add IFLA_GROUP to ifla_policy Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:00 +0200
  [PATCH 3.2 014/106] USB: iowarrior: fix info ioctl on big-endian  hosts Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:50 +0200
  [PATCH 3.2 002/106] af_key: Fix slab-out-of-bounds in  pfkey_compile_policy. Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:50 +0200
  [PATCH 3.2 009/106] ahci: Acer SA5-271 SSD Not Detected Fix Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:50 +0200
  [PATCH 3.2 001/106] xfrm: fix stack access out of bounds with  CONFIG_XFRM_SUB_POLICY Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:50 +0200
  Re: [PATCH 3.2 000/106] 3.2.93-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-09-10 16:40 +0200
    Re: [PATCH 3.2 000/106] 3.2.93-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 20:50 +0200

csiph-web