linux-2.6.7 Equalizer Load-balancer. eql.c. local non-privileged DoS

linux-2.6.7 Equalizer Load-balancer. eql.c. local non-privileged DoS

[Vitaly V. Bursov]

[-- Attachment #1: Type: text/plain, Size: 1019 bytes --]

Hello,

there are multiple vulns in drivers/net/eql.c

====
static int eql_g_slave_cfg(struct net_device *dev, slave_config_t __user *scp)
{
...
        if (copy_from_user(&sc, scp, sizeof (slave_config_t)))
                return -EFAULT;

        slave_dev = dev_get_by_name(sc.slave_name);

        ret = -EINVAL;

        spin_lock_bh(&eql->queue.lock);
        if (eql_is_slave(slave_dev)) {
...
====

and

====
static int eql_s_slave_cfg(struct net_device *dev, slave_config_t __user *scp)  
{
....
        if (copy_from_user(&sc, scp, sizeof (slave_config_t)))
                return -EFAULT;

        eql = dev->priv;
        slave_dev = dev_get_by_name(sc.slave_name);

        ret = -EINVAL;

        spin_lock_bh(&eql->queue.lock);
        if (eql_is_slave(slave_dev)) {
====

if there is no such device, dev_get_by_name returns NULL and everything dies.
Exploiting this is trivial.


Hopefully somebody will check this file carefully and fix it.

I am not in a list.
-- 
Thanks,
Vitaly
GPG Key ID: F95A23B9

[-- Attachment #2: Type: application/pgp-signature, Size: 189 bytes --]

Re: linux-2.6.7 Equalizer Load-balancer. eql.c. local non-privileged DoS

[Herbert Xu]

Vitaly V. Bursov <vitalyvb@ukr.net> wrote:
> 
> there are multiple vulns in drivers/net/eql.c
> 
> if there is no such device, dev_get_by_name returns NULL and everything dies.
> Exploiting this is trivial.

Thanks for the report.  This patch should fix them.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Cheers,
-- 
Visit Openswan at http://www.openswan.org/
Email:  Herbert Xu ~{PmV>HI~} <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
--
===== drivers/net/eql.c 1.13 vs edited =====
--- 1.13/drivers/net/eql.c	2004-06-05 01:50:36 +10:00
+++ edited/drivers/net/eql.c	2004-06-18 21:30:49 +10:00
@@ -497,6 +497,8 @@
 	slave_dev = dev_get_by_name(sc.slave_name);
 
 	ret = -EINVAL;
+	if (!slave_dev)
+		return ret;
 
 	spin_lock_bh(&eql->queue.lock);
 	if (eql_is_slave(slave_dev)) {
@@ -531,6 +533,8 @@
 	slave_dev = dev_get_by_name(sc.slave_name);
 
 	ret = -EINVAL;
+	if (!slave_dev)
+		return ret;
 
 	spin_lock_bh(&eql->queue.lock);
 	if (eql_is_slave(slave_dev)) {

Re: linux-2.6.7 Equalizer Load-balancer. eql.c. local non-privileged DoS

[Jeff Garzik]

applied