From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from phobos.denx.de (phobos.denx.de [85.214.62.61]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 1F2E0C4332F for ; Mon, 28 Nov 2022 19:51:35 +0000 (UTC) Received: from h2850616.stratoserver.net (localhost [IPv6:::1]) by phobos.denx.de (Postfix) with ESMTP id 6BF7F852E1; Mon, 28 Nov 2022 20:51:31 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de Authentication-Results: phobos.denx.de; dkim=pass (1024-bit key; unprotected) header.d=konsulko.com header.i=@konsulko.com header.b="iV/xfiM8"; dkim-atps=neutral Received: by phobos.denx.de (Postfix, from userid 109) id 756C3851A5; Mon, 28 Nov 2022 20:51:29 +0100 (CET) Received: from mail-ej1-x633.google.com (mail-ej1-x633.google.com [IPv6:2a00:1450:4864:20::633]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits)) (No client certificate requested) by phobos.denx.de (Postfix) with ESMTPS id CEB9C852D1 for ; Mon, 28 Nov 2022 20:51:24 +0100 (CET) Authentication-Results: phobos.denx.de; dmarc=pass (p=none dis=none) header.from=konsulko.com Authentication-Results: phobos.denx.de; spf=pass smtp.mailfrom=trini@konsulko.com Received: by mail-ej1-x633.google.com with SMTP id ml11so3698305ejb.6 for ; Mon, 28 Nov 2022 11:51:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=konsulko.com; s=google; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:from:to:cc:subject:date:message-id:reply-to; bh=6WqrwYB0m3Zyg4x7bo7n+R4iwr8sjVIf3NpMTaPh2VE=; b=iV/xfiM84CaZGzO3LRyiYjbnSqHGmKtBUf2UKEoI1DMEjCaVziWVfxrqXnWexOQJP3 +1l5AefLmep1y2wmd2tzBqgsp6nYsBlO3Bh0sFha3VoBz0WSNDEMQfQRlKycSJRLK00S HX4NJJN5koLJOc9s2RSVN6Jn4WRcvpU06UZz8= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=in-reply-to:content-disposition:mime-version:references:message-id :subject:cc:to:from:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=6WqrwYB0m3Zyg4x7bo7n+R4iwr8sjVIf3NpMTaPh2VE=; b=l1f5MwN3ya4zKwitskjKYtrg2BtCNOhz5ccpplq3inwXWVDsJnOPRDDkIFx7HBtlwk DVGeaH0sXAK6TROrPPFA6bVnSatXwxfijlH/6VyqC1D7w9qbibPSW35ZuZC0tNjFdkxk T0vv0UMRV0u6EUB5GidygByeM3ZHyDH+C9u0Axul9ZTxg7Obj2rfhkIeX8SS5MEKB/45 IgynTuy+YbRFhxe+kb7vGJLM7X2wW7OLALC0bNumNiqyENaqMmupaUXUR96mgUr3xkvK ASuRMi1cIEaKHhxv2OBGRD5GLtjGtQ4BWOUDQlWMQCFk2rjXTo4tZelB1y+X5m2kTdYl kFbA== X-Gm-Message-State: ANoB5pnhJ1Fpcp0FazXGh6GDtuhbTOyuZPpakGQGUyITLMZGjrALffIe LB9q9+ryvBoampxcqj8mzk9+BQ== X-Google-Smtp-Source: AA0mqf420C81P3Jf6eoY1DgDBFHG3Dt/Tb1pibh16Smn1G9zM5Hfe4vwt4YvpaTLqWDwGmT1AtYYlQ== X-Received: by 2002:a17:906:d20a:b0:7a9:8d8e:c3df with SMTP id w10-20020a170906d20a00b007a98d8ec3dfmr29308689ejz.519.1669665078791; Mon, 28 Nov 2022 11:51:18 -0800 (PST) Received: from bill-the-cat (2603-6081-7b00-6400-69da-bdfc-6a2b-e036.res6.spectrum.com. [2603:6081:7b00:6400:69da:bdfc:6a2b:e036]) by smtp.gmail.com with ESMTPSA id cd26-20020a170906b35a00b007a4e02e32ffsm5282612ejb.60.2022.11.28.11.51.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 28 Nov 2022 11:51:18 -0800 (PST) Date: Mon, 28 Nov 2022 14:51:13 -0500 From: Tom Rini To: Rasmus Villemoes Cc: u-boot@lists.denx.de, Fabio Estevam , Nicolas Bidron , Joe Hershberger , Ramon Fried Subject: Re: [PATCH 2/6] net: compare received length to sizeof(ip_hdr), not sizeof(ip_udp_hdr) Message-ID: <20221128195113.GC3787616@bill-the-cat> References: <20221014174342.3216982-1-rasmus.villemoes@prevas.dk> <20221014174342.3216982-3-rasmus.villemoes@prevas.dk> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="csgZZokDzjk698W/" Content-Disposition: inline In-Reply-To: <20221014174342.3216982-3-rasmus.villemoes@prevas.dk> X-Clacks-Overhead: GNU Terry Pratchett X-BeenThere: u-boot@lists.denx.de X-Mailman-Version: 2.1.39 Precedence: list List-Id: U-Boot discussion List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: u-boot-bounces@lists.denx.de Sender: "U-Boot" X-Virus-Scanned: clamav-milter 0.103.6 at phobos.denx.de X-Virus-Status: Clean --csgZZokDzjk698W/ Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Oct 14, 2022 at 07:43:38PM +0200, Rasmus Villemoes wrote: > While the code mostly/only handles UDP packets, it's possible for the > last fragment of a fragmented UDP packet to be smaller than 28 bytes; > it can be as small as 21 bytes (an IP header plus one byte of > payload). So until we've performed the defragmentation step and thus > know whether we're now holding a full packet, we should only check for > the existence of the fields in the ip header, i.e. that there are at > least 20 bytes present. >=20 > In practice, we always seem to be handed a "len" of minimum 60 from the > device layer, i.e. minimal ethernet frame length minus FCS, so this is > mostly theoretical. >=20 > After we've fetched the header's claimed length and used that to > update the len variable, check that the header itself claims to be the > minimal possible length. >=20 > This is probably how CVE-2022-30552 should have been dealt with in the > first place, because net_defragment() is not the only place that wants > to know the size of the IP datagram payload: If we receive a > non-fragmented ICMP packet, we pass "len" to receive_icmp() which in > turn may pass it to ping_receive() which does >=20 > compute_ip_checksum(icmph, len - IP_HDR_SIZE) >=20 > and due to the signature of compute_ip_checksum(), that would then > lead to accessing ~4G of address space, very likely leading to a > crash. >=20 > Signed-off-by: Rasmus Villemoes Applied to u-boot/master, thanks! --=20 Tom --csgZZokDzjk698W/ Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQGzBAABCgAdFiEEGjx/cOCPqxcHgJu/FHw5/5Y0tywFAmOFETEACgkQFHw5/5Y0 tyzoEAv9FoRL+zLggzNxFBLy51irS/COECOMpfqIsCo5nAvXEJhvAIiUJQiwq3gF ++2tXnV8BoTijUR1TUY9OO28ErgK89ObRqAWHelcqrQv63kVZTT4p8uFNfBiIhDg NglnwmF/+5ddqM5FJ+nhy5QYZ8JQLmD6ZEB2+RHEISmpzZnkRozvMC+XDsbfKohZ ps0KtTOP9lTqq1dupmmgiY0dKveBtVAwRZrWjPpY2WsQ1LfwB2DJgg0CvF6Kk/w1 +2wI+0ByvGIkNMiOIZo3dak5cS4rmE5e/cVtY+RR7F4CW0w+3RkYSrdrd5/MIZ80 vmJxmcz42aGE2RSvdVreVyh1mim0eJjQKEKQqsY937H8gbPPb7D4QKZQ0v+P1R/8 60m92Kc5iQk4DcKFOqlbYg9QMEZm3PAURuK4ygDZ/Ge4B0zbqtNjFDIj5TgPGHW6 auZdlDb0VEePztKHHGOG7HxHHr+fnDzT3q5CqwxPEmcZUmx1EkYkJZL5tlRI+t7E Hpy4AP/q =ch7R -----END PGP SIGNATURE----- --csgZZokDzjk698W/--