From: Rusty Russell <rusty@rustcorp.com.au>
To: Ken Ashcraft <kash@stanford.edu>
Cc: linux-kernel@vger.kernel.org, mc@cs.Stanford.EDU, laforge@gnumonks.org
Subject: Re: [CHECKER] Probable Security Errors in 2.4.12-ac3
Date: Thu, 25 Oct 2001 11:59:42 +1000 [thread overview]
Message-ID: <20011025115942.31d3fdbf.rusty@rustcorp.com.au> (raw)
In-Reply-To: <Pine.GSO.4.33.0110202220470.963-100000@saga5.Stanford.EDU>
In-Reply-To: <Pine.GSO.4.33.0110202220470.963-100000@saga5.Stanford.EDU>
On Sat, 20 Oct 2001 22:28:50 -0700 (PDT)
Ken Ashcraft <kash@stanford.edu> wrote:
> Hi All,
Hi Ken,
I'm prepared to live with the iptables ones:
> ---------------------------------------------------------
> [BUG] MINOR checked indirectly.
> /home/kash/linux/2.4.12/net/ipv6/netfilter/ip6_tables.c:1111:do_replace: ERROR:RANGE:1106:1111: Using user length "size" as argument to "copy_from_user" [type=LOCAL] [state = need_ub] set by 'copy_from_user':1106 [distance=13]
>
> if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
> return -EFAULT;
>
> newinfo = vmalloc(sizeof(struct ip6t_table_info)
> Start --->
> + SMP_ALIGN(tmp.size) * smp_num_cpus);
> if (!newinfo)
> return -ENOMEM;
>
> if (copy_from_user(newinfo->entries, user + sizeof(tmp),
> Error --->
> tmp.size) != 0) {
> ret = -EFAULT;
> goto free_newinfo;
> }
Yes, if a malicious user has CAP_NET_ADMIN they can hit the BUG() in vmalloc().
Of course, we have other problems then, too...
Still, here is the fix, if only to stop you guys complaining 8)
diff -urN -I \$.*\$ --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.12-official/net/ipv4/netfilter/ip_tables.c working-2.4.12-nfsize/net/ipv4/netfilter/ip_tables.c
--- linux-2.4.12-official/net/ipv4/netfilter/ip_tables.c Wed Oct 10 17:37:58 2001
+++ working-2.4.12-nfsize/net/ipv4/netfilter/ip_tables.c Thu Oct 25 11:56:01 2001
@@ -1059,6 +1059,10 @@
if (len != sizeof(tmp) + tmp.size)
return -ENOPROTOOPT;
+ /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
+ if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)
+ return -ENOMEM;
+
newinfo = vmalloc(sizeof(struct ipt_table_info)
+ SMP_ALIGN(tmp.size) * smp_num_cpus);
if (!newinfo)
diff -urN -I \$.*\$ --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.12-official/net/ipv6/netfilter/ip6_tables.c working-2.4.12-nfsize/net/ipv6/netfilter/ip6_tables.c
--- linux-2.4.12-official/net/ipv6/netfilter/ip6_tables.c Wed Oct 10 17:37:58 2001
+++ working-2.4.12-nfsize/net/ipv6/netfilter/ip6_tables.c Thu Oct 25 11:56:27 2001
@@ -1102,6 +1102,10 @@
if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
return -EFAULT;
+ /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
+ if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)
+ return -ENOMEM;
+
newinfo = vmalloc(sizeof(struct ip6t_table_info)
+ SMP_ALIGN(tmp.size) * smp_num_cpus);
if (!newinfo)
Rusty.
prev parent reply other threads:[~2001-10-25 2:58 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2001-10-21 5:28 [CHECKER] Probable Security Errors in 2.4.12-ac3 Ken Ashcraft
2001-10-21 8:08 ` Manfred Spraul
2001-10-21 9:01 ` Ken Ashcraft
2001-10-23 7:32 ` Jens Axboe
2001-10-25 1:59 ` Rusty Russell [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20011025115942.31d3fdbf.rusty@rustcorp.com.au \
--to=rusty@rustcorp.com.au \
--cc=kash@stanford.edu \
--cc=laforge@gnumonks.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mc@cs.Stanford.EDU \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox