From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37802) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XUHep-0003FM-DU for qemu-devel@nongnu.org; Wed, 17 Sep 2014 12:00:44 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XUHei-0000Mr-H8 for qemu-devel@nongnu.org; Wed, 17 Sep 2014 12:00:39 -0400 Received: from david.siemens.de ([192.35.17.14]:44177) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XUHei-0000L9-7b for qemu-devel@nongnu.org; Wed, 17 Sep 2014 12:00:32 -0400 Message-ID: <5419B019.5060103@siemens.com> Date: Wed, 17 Sep 2014 18:00:25 +0200 From: Jan Kiszka MIME-Version: 1.0 References: <20140917114130.GT9321@dhcp-25-225.brq.redhat.com> In-Reply-To: <20140917114130.GT9321@dhcp-25-225.brq.redhat.com> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] slirp: udp: fix NULL pointer dereference because of uninitialized socket List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Petr Matousek , qemu-devel@nongnu.org On 2014-09-17 13:41, Petr Matousek wrote: > When guest sends udp packet with source port and source addr 0, > uninitialized socket is picked up when looking for matching and already > created udp sockets, and later passed to sosendto() where NULL pointer > dereference is hit during so->slirp->vnetwork_mask.s_addr access. > > Fix this by checking that the socket is in initialized state. > > This is CVE-2014-3640. > > Signed-off-by: Petr Matousek > Reported-by: Xavier Mehrenberger > Reported-by: Stephane Duverger > Reviewed-by: Michael S. Tsirkin > --- > slirp/udp.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/slirp/udp.c b/slirp/udp.c > index 8cc6cb6..4affcc6 100644 > --- a/slirp/udp.c > +++ b/slirp/udp.c > @@ -152,7 +152,7 @@ udp_input(register struct mbuf *m, int iphlen) > * Locate pcb for datagram. > */ > so = slirp->udp_last_so; > - if (so->so_lport != uh->uh_sport || > + if (!so->so_state || so->so_lport != uh->uh_sport || I think it would be clearer to test so against &slirp->udb. That's done later on in this code as well to differentiate between valid sockets and this stub. Jan > so->so_laddr.s_addr != ip->ip_src.s_addr) { > struct socket *tmp; > > -- Siemens AG, Corporate Technology, CT RTC ITP SES-DE Corporate Competence Center Embedded Linux