Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1729877

[PATCH 3.2 002/106] af_key: Fix slab-out-of-bounds in pfkey_compile_policy.

Show all headers | View raw

3.2.93-rc1 review patch.  If anyone has any objections, please let me know.

------------------

From: Steffen Klassert <steffen.klassert@secunet.com>

commit d90c902449a7561f1b1d58ba5a0d11728ce8b0b2 upstream.

The sadb_x_sec_len is stored in the unit 'byte divided by eight'.
So we have to multiply this value by eight before we can do
size checks. Otherwise we may get a slab-out-of-bounds when
we memcpy the user sec_ctx.

Fixes: df71837d502 ("[LSM-IPSec]: Security association restriction.")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Tested-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
 net/key/af_key.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/net/key/af_key.c
+++ b/net/key/af_key.c
@@ -3230,7 +3230,7 @@ static struct xfrm_policy *pfkey_compile
 		p += pol->sadb_x_policy_len*8;
 		sec_ctx = (struct sadb_x_sec_ctx *)p;
 		if (len < pol->sadb_x_policy_len*8 +
-		    sec_ctx->sadb_x_sec_len) {
+		    sec_ctx->sadb_x_sec_len*8) {
 			*dir = -EINVAL;
 			goto out;
 		}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.2 000/106] 3.2.93-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:00 +0200
  [PATCH 3.2 017/106] USB: gadget: dummy_hcd: fix hub-descriptor  removable fields Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:00 +0200
  [PATCH 3.2 090/106] rtnetlink: add IFLA_GROUP to ifla_policy Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:00 +0200
  [PATCH 3.2 014/106] USB: iowarrior: fix info ioctl on big-endian  hosts Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:50 +0200
  [PATCH 3.2 002/106] af_key: Fix slab-out-of-bounds in  pfkey_compile_policy. Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:50 +0200
  [PATCH 3.2 009/106] ahci: Acer SA5-271 SSD Not Detected Fix Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:50 +0200
  [PATCH 3.2 001/106] xfrm: fix stack access out of bounds with  CONFIG_XFRM_SUB_POLICY Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 01:50 +0200
  Re: [PATCH 3.2 000/106] 3.2.93-rc1 review Guenter Roeck <linux@roeck-us.net> - 2017-09-10 16:40 +0200
    Re: [PATCH 3.2 000/106] 3.2.93-rc1 review Ben Hutchings <ben@decadent.org.uk> - 2017-09-10 20:50 +0200

csiph-web