* [PATCH net] net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs
@ 2013-09-07 7:41 Daniel Borkmann
2013-09-08 5:35 ` Jesse Gross
0 siblings, 1 reply; 3+ messages in thread
From: Daniel Borkmann @ 2013-09-07 7:41 UTC (permalink / raw)
To: davem; +Cc: netdev, jesse, Andy Zhou
In function __parse_flow_nlattrs(), we check for condition
(type > OVS_KEY_ATTR_MAX) and if true, print an error, but we do
not return from this function as in other checks. It seems this
has been forgotten, as otherwise, we could access beyond the
memory of ovs_key_lens, which is of ovs_key_lens[OVS_KEY_ATTR_MAX + 1].
Hence, a maliciously prepared nla_type from user space could access
beyond this upper limit.
Introduced by 03f0d916a ("openvswitch: Mega flow implementation").
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Andy Zhou <azhou@nicira.com>
---
net/openvswitch/flow.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index fb36f85..410db90 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c
@@ -1178,6 +1178,7 @@ static int __parse_flow_nlattrs(const struct nlattr *attr,
if (type > OVS_KEY_ATTR_MAX) {
OVS_NLERR("Unknown key attribute (type=%d, max=%d).\n",
type, OVS_KEY_ATTR_MAX);
+ return -EINVAL;
}
if (attrs & (1 << type)) {
--
1.7.11.7
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs
2013-09-07 7:41 [PATCH net] net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs Daniel Borkmann
@ 2013-09-08 5:35 ` Jesse Gross
2013-09-11 20:14 ` David Miller
0 siblings, 1 reply; 3+ messages in thread
From: Jesse Gross @ 2013-09-08 5:35 UTC (permalink / raw)
To: Daniel Borkmann; +Cc: David Miller, netdev, Andy Zhou, dev@openvswitch.org
On Sat, Sep 7, 2013 at 12:41 AM, Daniel Borkmann <dborkman@redhat.com> wrote:
> In function __parse_flow_nlattrs(), we check for condition
> (type > OVS_KEY_ATTR_MAX) and if true, print an error, but we do
> not return from this function as in other checks. It seems this
> has been forgotten, as otherwise, we could access beyond the
> memory of ovs_key_lens, which is of ovs_key_lens[OVS_KEY_ATTR_MAX + 1].
> Hence, a maliciously prepared nla_type from user space could access
> beyond this upper limit.
>
> Introduced by 03f0d916a ("openvswitch: Mega flow implementation").
>
> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
> Cc: Andy Zhou <azhou@nicira.com>
Yeah, looks like a mistake to me.
Acked-by: Jesse Gross <jesse@nicira.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs
2013-09-08 5:35 ` Jesse Gross
@ 2013-09-11 20:14 ` David Miller
0 siblings, 0 replies; 3+ messages in thread
From: David Miller @ 2013-09-11 20:14 UTC (permalink / raw)
To: jesse; +Cc: dborkman, netdev, azhou, dev
From: Jesse Gross <jesse@nicira.com>
Date: Sat, 7 Sep 2013 22:35:33 -0700
> On Sat, Sep 7, 2013 at 12:41 AM, Daniel Borkmann <dborkman@redhat.com> wrote:
>> In function __parse_flow_nlattrs(), we check for condition
>> (type > OVS_KEY_ATTR_MAX) and if true, print an error, but we do
>> not return from this function as in other checks. It seems this
>> has been forgotten, as otherwise, we could access beyond the
>> memory of ovs_key_lens, which is of ovs_key_lens[OVS_KEY_ATTR_MAX + 1].
>> Hence, a maliciously prepared nla_type from user space could access
>> beyond this upper limit.
>>
>> Introduced by 03f0d916a ("openvswitch: Mega flow implementation").
>>
>> Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
>> Cc: Andy Zhou <azhou@nicira.com>
>
> Yeah, looks like a mistake to me.
>
> Acked-by: Jesse Gross <jesse@nicira.com>
Applied, thanks.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2013-09-11 20:14 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-09-07 7:41 [PATCH net] net: ovs: flow: fix potential illegal memory access in __parse_flow_nlattrs Daniel Borkmann
2013-09-08 5:35 ` Jesse Gross
2013-09-11 20:14 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).