Re: [PATCH v2] netfilter: nfnetlink: Improve input length sanitization in nfnetlink_rcv

From	Pablo Neira Ayuso <pablo@netfilter.org>
Newsgroups	linux.kernel
Subject	Re: [PATCH v2] netfilter: nfnetlink: Improve input length sanitization in nfnetlink_rcv
Date	2017-06-27 18:00 +0200
Message-ID	<tX14e-2Bz-5@gated-at.bofh.it> (permalink)
References	<tPJc7-7aN-27@gated-at.bofh.it> <tPJF7-7mI-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On Wed, Jun 07, 2017 at 03:50:38PM +0200, Mateusz Jurczyk wrote:
> Verify that the length of the socket buffer is sufficient to cover the
> nlmsghdr structure before accessing the nlh->nlmsg_len field for further
> input sanitization. If the client only supplies 1-3 bytes of data in
> sk_buff, then nlh->nlmsg_len remains partially uninitialized and
> contains leftover memory from the corresponding kernel allocation.
> Operating on such data may result in indeterminate evaluation of the
> nlmsg_len < NLMSG_HDRLEN expression.
> 
> The bug was discovered by a runtime instrumentation designed to detect
> use of uninitialized memory in the kernel. The patch prevents this and
> other similar tools (e.g. KMSAN) from flagging this behavior in the future.

Applied, thanks.

Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Re: [PATCH v2] netfilter: nfnetlink: Improve input length  sanitization in nfnetlink_rcv Pablo Neira Ayuso <pablo@netfilter.org> - 2017-06-27 18:00 +0200
  Re: [PATCH v2] netfilter: nfnetlink: Improve input length  sanitization in nfnetlink_rcv Pablo Neira Ayuso <pablo@netfilter.org> - 2017-06-27 19:10 +0200
    Re: [PATCH v2] netfilter: nfnetlink: Improve input length  sanitization in nfnetlink_rcv Pablo Neira Ayuso <pablo@netfilter.org> - 2017-06-29 18:30 +0200
      Re: [PATCH v2] netfilter: nfnetlink: Improve input length  sanitization in nfnetlink_rcv Mateusz Jurczyk <mjurczyk@google.com> - 2017-06-30 17:20 +0200

csiph-web