From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Lin Ma <linma@zju.edu.cn>,
Steffen Klassert <steffen.klassert@secunet.com>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.14 19/57] net: xfrm: Fix xfrm_address_filter OOB read
Date: Mon, 28 Aug 2023 12:12:39 +0200 [thread overview]
Message-ID: <20230828101144.940103042@linuxfoundation.org> (raw)
In-Reply-To: <20230828101144.231099710@linuxfoundation.org>
4.14-stable review patch. If anyone has any objections, please let me know.
------------------
From: Lin Ma <linma@zju.edu.cn>
[ Upstream commit dfa73c17d55b921e1d4e154976de35317e43a93a ]
We found below OOB crash:
[ 44.211730] ==================================================================
[ 44.212045] BUG: KASAN: slab-out-of-bounds in memcmp+0x8b/0xb0
[ 44.212045] Read of size 8 at addr ffff88800870f320 by task poc.xfrm/97
[ 44.212045]
[ 44.212045] CPU: 0 PID: 97 Comm: poc.xfrm Not tainted 6.4.0-rc7-00072-gdad9774deaf1-dirty #4
[ 44.212045] Call Trace:
[ 44.212045] <TASK>
[ 44.212045] dump_stack_lvl+0x37/0x50
[ 44.212045] print_report+0xcc/0x620
[ 44.212045] ? __virt_addr_valid+0xf3/0x170
[ 44.212045] ? memcmp+0x8b/0xb0
[ 44.212045] kasan_report+0xb2/0xe0
[ 44.212045] ? memcmp+0x8b/0xb0
[ 44.212045] kasan_check_range+0x39/0x1c0
[ 44.212045] memcmp+0x8b/0xb0
[ 44.212045] xfrm_state_walk+0x21c/0x420
[ 44.212045] ? __pfx_dump_one_state+0x10/0x10
[ 44.212045] xfrm_dump_sa+0x1e2/0x290
[ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10
[ 44.212045] ? __kernel_text_address+0xd/0x40
[ 44.212045] ? kasan_unpoison+0x27/0x60
[ 44.212045] ? mutex_lock+0x60/0xe0
[ 44.212045] ? __pfx_mutex_lock+0x10/0x10
[ 44.212045] ? kasan_save_stack+0x22/0x50
[ 44.212045] netlink_dump+0x322/0x6c0
[ 44.212045] ? __pfx_netlink_dump+0x10/0x10
[ 44.212045] ? mutex_unlock+0x7f/0xd0
[ 44.212045] ? __pfx_mutex_unlock+0x10/0x10
[ 44.212045] __netlink_dump_start+0x353/0x430
[ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410
[ 44.212045] ? __pfx__raw_spin_lock_irqsave+0x10/0x10
[ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[ 44.212045] ? __pfx_xfrm_dump_sa+0x10/0x10
[ 44.212045] ? __pfx_xfrm_dump_sa_done+0x10/0x10
[ 44.212045] ? __stack_depot_save+0x382/0x4e0
[ 44.212045] ? filter_irq_stacks+0x1c/0x70
[ 44.212045] ? kasan_save_stack+0x32/0x50
[ 44.212045] ? kasan_save_stack+0x22/0x50
[ 44.212045] ? kasan_set_track+0x25/0x30
[ 44.212045] ? __kasan_slab_alloc+0x59/0x70
[ 44.212045] ? kmem_cache_alloc_node+0xf7/0x260
[ 44.212045] ? kmalloc_reserve+0xab/0x120
[ 44.212045] ? __alloc_skb+0xcf/0x210
[ 44.212045] ? netlink_sendmsg+0x509/0x700
[ 44.212045] ? sock_sendmsg+0xde/0xe0
[ 44.212045] ? __sys_sendto+0x18d/0x230
[ 44.212045] ? __x64_sys_sendto+0x71/0x90
[ 44.212045] ? do_syscall_64+0x3f/0x90
[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045] ? netlink_sendmsg+0x509/0x700
[ 44.212045] ? sock_sendmsg+0xde/0xe0
[ 44.212045] ? __sys_sendto+0x18d/0x230
[ 44.212045] ? __x64_sys_sendto+0x71/0x90
[ 44.212045] ? do_syscall_64+0x3f/0x90
[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045] ? kasan_save_stack+0x22/0x50
[ 44.212045] ? kasan_set_track+0x25/0x30
[ 44.212045] ? kasan_save_free_info+0x2e/0x50
[ 44.212045] ? __kasan_slab_free+0x10a/0x190
[ 44.212045] ? kmem_cache_free+0x9c/0x340
[ 44.212045] ? netlink_recvmsg+0x23c/0x660
[ 44.212045] ? sock_recvmsg+0xeb/0xf0
[ 44.212045] ? __sys_recvfrom+0x13c/0x1f0
[ 44.212045] ? __x64_sys_recvfrom+0x71/0x90
[ 44.212045] ? do_syscall_64+0x3f/0x90
[ 44.212045] ? entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045] ? copyout+0x3e/0x50
[ 44.212045] netlink_rcv_skb+0xd6/0x210
[ 44.212045] ? __pfx_xfrm_user_rcv_msg+0x10/0x10
[ 44.212045] ? __pfx_netlink_rcv_skb+0x10/0x10
[ 44.212045] ? __pfx_sock_has_perm+0x10/0x10
[ 44.212045] ? mutex_lock+0x8d/0xe0
[ 44.212045] ? __pfx_mutex_lock+0x10/0x10
[ 44.212045] xfrm_netlink_rcv+0x44/0x50
[ 44.212045] netlink_unicast+0x36f/0x4c0
[ 44.212045] ? __pfx_netlink_unicast+0x10/0x10
[ 44.212045] ? netlink_recvmsg+0x500/0x660
[ 44.212045] netlink_sendmsg+0x3b7/0x700
[ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10
[ 44.212045] ? __pfx_netlink_sendmsg+0x10/0x10
[ 44.212045] sock_sendmsg+0xde/0xe0
[ 44.212045] __sys_sendto+0x18d/0x230
[ 44.212045] ? __pfx___sys_sendto+0x10/0x10
[ 44.212045] ? rcu_core+0x44a/0xe10
[ 44.212045] ? __rseq_handle_notify_resume+0x45b/0x740
[ 44.212045] ? _raw_spin_lock_irq+0x81/0xe0
[ 44.212045] ? __pfx___rseq_handle_notify_resume+0x10/0x10
[ 44.212045] ? __pfx_restore_fpregs_from_fpstate+0x10/0x10
[ 44.212045] ? __pfx_blkcg_maybe_throttle_current+0x10/0x10
[ 44.212045] ? __pfx_task_work_run+0x10/0x10
[ 44.212045] __x64_sys_sendto+0x71/0x90
[ 44.212045] do_syscall_64+0x3f/0x90
[ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045] RIP: 0033:0x44b7da
[ 44.212045] RSP: 002b:00007ffdc8838548 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 44.212045] RAX: ffffffffffffffda RBX: 00007ffdc8839978 RCX: 000000000044b7da
[ 44.212045] RDX: 0000000000000038 RSI: 00007ffdc8838770 RDI: 0000000000000003
[ 44.212045] RBP: 00007ffdc88385b0 R08: 00007ffdc883858c R09: 000000000000000c
[ 44.212045] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[ 44.212045] R13: 00007ffdc8839968 R14: 00000000004c37d0 R15: 0000000000000001
[ 44.212045] </TASK>
[ 44.212045]
[ 44.212045] Allocated by task 97:
[ 44.212045] kasan_save_stack+0x22/0x50
[ 44.212045] kasan_set_track+0x25/0x30
[ 44.212045] __kasan_kmalloc+0x7f/0x90
[ 44.212045] __kmalloc_node_track_caller+0x5b/0x140
[ 44.212045] kmemdup+0x21/0x50
[ 44.212045] xfrm_dump_sa+0x17d/0x290
[ 44.212045] netlink_dump+0x322/0x6c0
[ 44.212045] __netlink_dump_start+0x353/0x430
[ 44.212045] xfrm_user_rcv_msg+0x3a4/0x410
[ 44.212045] netlink_rcv_skb+0xd6/0x210
[ 44.212045] xfrm_netlink_rcv+0x44/0x50
[ 44.212045] netlink_unicast+0x36f/0x4c0
[ 44.212045] netlink_sendmsg+0x3b7/0x700
[ 44.212045] sock_sendmsg+0xde/0xe0
[ 44.212045] __sys_sendto+0x18d/0x230
[ 44.212045] __x64_sys_sendto+0x71/0x90
[ 44.212045] do_syscall_64+0x3f/0x90
[ 44.212045] entry_SYSCALL_64_after_hwframe+0x72/0xdc
[ 44.212045]
[ 44.212045] The buggy address belongs to the object at ffff88800870f300
[ 44.212045] which belongs to the cache kmalloc-64 of size 64
[ 44.212045] The buggy address is located 32 bytes inside of
[ 44.212045] allocated 36-byte region [ffff88800870f300, ffff88800870f324)
[ 44.212045]
[ 44.212045] The buggy address belongs to the physical page:
[ 44.212045] page:00000000e4de16ee refcount:1 mapcount:0 mapping:000000000 ...
[ 44.212045] flags: 0x100000000000200(slab|node=0|zone=1)
[ 44.212045] page_type: 0xffffffff()
[ 44.212045] raw: 0100000000000200 ffff888004c41640 dead000000000122 0000000000000000
[ 44.212045] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000
[ 44.212045] page dumped because: kasan: bad access detected
[ 44.212045]
[ 44.212045] Memory state around the buggy address:
[ 44.212045] ffff88800870f200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[ 44.212045] ffff88800870f280: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
[ 44.212045] >ffff88800870f300: 00 00 00 00 04 fc fc fc fc fc fc fc fc fc fc fc
[ 44.212045] ^
[ 44.212045] ffff88800870f380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 44.212045] ffff88800870f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 44.212045] ==================================================================
By investigating the code, we find the root cause of this OOB is the lack
of checks in xfrm_dump_sa(). The buggy code allows a malicious user to pass
arbitrary value of filter->splen/dplen. Hence, with crafted xfrm states,
the attacker can achieve 8 bytes heap OOB read, which causes info leak.
if (attrs[XFRMA_ADDRESS_FILTER]) {
filter = kmemdup(nla_data(attrs[XFRMA_ADDRESS_FILTER]),
sizeof(*filter), GFP_KERNEL);
if (filter == NULL)
return -ENOMEM;
// NO MORE CHECKS HERE !!!
}
This patch fixes the OOB by adding necessary boundary checks, just like
the code in pfkey_dump() function.
Fixes: d3623099d350 ("ipsec: add support of limited SA dump")
Signed-off-by: Lin Ma <linma@zju.edu.cn>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
net/xfrm/xfrm_user.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index ad30e0d8b28e9..c932ec65cfa09 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -1000,6 +1000,15 @@ static int xfrm_dump_sa(struct sk_buff *skb, struct netlink_callback *cb)
sizeof(*filter), GFP_KERNEL);
if (filter == NULL)
return -ENOMEM;
+
+ /* see addr_match(), (prefix length >> 5) << 2
+ * will be used to compare xfrm_address_t
+ */
+ if (filter->splen > (sizeof(xfrm_address_t) << 3) ||
+ filter->dplen > (sizeof(xfrm_address_t) << 3)) {
+ kfree(filter);
+ return -EINVAL;
+ }
}
if (attrs[XFRMA_PROTO])
--
2.40.1
next prev parent reply other threads:[~2023-08-28 10:15 UTC|newest]
Thread overview: 65+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-08-28 10:12 [PATCH 4.14 00/57] 4.14.324-rc1 review Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 01/57] lib/mpi: Eliminate unused umul_ppmm definitions for MIPS Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 02/57] drm/radeon: Fix integer overflow in radeon_cs_parser_init Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 03/57] ALSA: emu10k1: roll up loops in DSP setup code for Audigy Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 04/57] quota: Properly disable quotas when add_dquot_ref() fails Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 05/57] quota: fix warning in dqgrab() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 06/57] udf: Fix uninitialized array access for some pathnames Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 07/57] fs: jfs: Fix UBSAN: array-index-out-of-bounds in dbAllocDmapLev Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 08/57] MIPS: dec: prom: Address -Warray-bounds warning Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 09/57] FS: JFS: Fix null-ptr-deref Read in txBegin Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 10/57] FS: JFS: Check for read-only mounted filesystem " Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 11/57] media: v4l2-mem2mem: add lock to protect parameter num_rdy Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 12/57] media: platform: mediatek: vpu: fix NULL ptr dereference Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 13/57] gfs2: Fix possible data races in gfs2_show_options() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 14/57] pcmcia: rsrc_nonstatic: Fix memory leak in nonstatic_release_resource_db() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 15/57] Bluetooth: L2CAP: Fix use-after-free Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 16/57] drm/amdgpu: Fix potential fence use-after-free v2 Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 17/57] fbdev: mmp: fix value check in mmphw_probe() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 18/57] powerpc/rtas_flash: allow user copy to flash block cache objects Greg Kroah-Hartman
2023-08-28 10:12 ` Greg Kroah-Hartman [this message]
2023-08-28 10:12 ` [PATCH 4.14 20/57] net: af_key: fix sadb_x_filter validation Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 21/57] ip6_vti: fix slab-use-after-free in decode_session6 Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 22/57] ip_vti: fix potential " Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 23/57] xfrm: add NULL check in xfrm_update_ae_params Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 24/57] netfilter: nft_dynset: disallow object maps Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 25/57] team: Fix incorrect deletion of ETH_P_8021AD protocol vid from slaves Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 26/57] i40e: fix misleading debug logs Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 27/57] sock: Fix misuse of sk_under_memory_pressure() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 28/57] net: do not allow gso_size to be set to GSO_BY_FRAGS Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 29/57] ALSA: usb-audio: Add support for Mythware XA001AU capture and playback interfaces Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 30/57] cifs: Release folio lock on fscache read hit Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 31/57] mmc: wbsd: fix double mmc_free_host() in wbsd_init() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 32/57] serial: 8250: Fix oops for port->pm on uart_change_pm() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 33/57] binder: fix memory leak in binder_init() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 34/57] test_firmware: prevent race conditions by a correct implementation of locking Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 35/57] netfilter: set default timeout to 3 secs for sctp shutdown send and recv state Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 36/57] ASoC: rt5665: add missed regulator_bulk_disable Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 37/57] af_unix: Fix null-ptr-deref in unix_stream_sendpage() Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 38/57] net: fix the RTO timer retransmitting skb every 1ms if linear option is enabled Greg Kroah-Hartman
2023-08-28 10:12 ` [PATCH 4.14 39/57] net: xfrm: Amend XFRMA_SEC_CTX nla_policy structure Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 40/57] net: phy: broadcom: stub c45 read/write for 54810 Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 41/57] tracing: Fix memleak due to race between current_tracer and trace Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 42/57] sock: annotate data-races around prot->memory_pressure Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 43/57] igb: Avoid starting unnecessary workqueues Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 44/57] ipvs: Improve robustness to the ipvs sysctl Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 45/57] ipvs: fix racy memcpy in proc_do_sync_threshold Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 46/57] ibmveth: Use dcbf rather than dcbfl Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 47/57] batman-adv: Trigger events for auto adjusted MTU Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 48/57] batman-adv: Do not get eth header before batadv_check_management_packet Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 49/57] batman-adv: Fix TT global entry leak when client roamed back Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 50/57] batman-adv: Fix batadv_v_ogm_aggr_send memory leak Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 51/57] lib/clz_ctz.c: Fix __clzdi2() and __ctzdi2() for 32-bit kernels Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 52/57] media: vcodec: Fix potential array out-of-bounds in encoder queue_setup Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 53/57] x86/fpu: Set X86_FEATURE_OSXSAVE feature after enabling OSXSAVE in CR4 Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 54/57] rtnetlink: Reject negative ifindexes in RTM_NEWLINK Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 55/57] scsi: snic: Fix double free in snic_tgt_create() Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 56/57] scsi: core: raid_class: Remove raid_component_add() Greg Kroah-Hartman
2023-08-28 10:13 ` [PATCH 4.14 57/57] dma-buf/sw_sync: Avoid recursive lock during fence signal Greg Kroah-Hartman
2023-08-29 3:01 ` [PATCH 4.14 00/57] 4.14.324-rc1 review Daniel Díaz
2023-08-29 11:57 ` Nathan Lynch
2023-08-30 12:32 ` Greg Kroah-Hartman
2023-08-30 1:56 ` Guenter Roeck
2023-08-30 12:33 ` Greg Kroah-Hartman
2023-08-30 10:24 ` Jon Hunter
2023-08-30 11:31 ` Pavel Machek
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230828101144.940103042@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linma@zju.edu.cn \
--cc=patches@lists.linux.dev \
--cc=sashal@kernel.org \
--cc=stable@vger.kernel.org \
--cc=steffen.klassert@secunet.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).