* [PATCH 2/3] net: packet: fix information leak to userland @ 2010-10-31 17:10 Vasiliy Kulikov 2010-11-01 9:14 ` walter harms 0 siblings, 1 reply; 8+ messages in thread From: Vasiliy Kulikov @ 2010-10-31 17:10 UTC (permalink / raw) To: kernel-janitors Cc: David S. Miller, Jiri Pirko, Eric Dumazet, netdev, linux-kernel packet_getname_spkt() doesn't initialize all members of sa_data field of sockaddr struct if strlen(dev->name) < 13. This structure is then copied to userland. It leads to leaking of contents of kernel stack memory. We have to fully fill sa_data with strncpy() instead of strlcpy(). The same with packet_getname(): it doesn't initialize sll_pkttype field of sockaddr_ll. Set it to zero. Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> --- net/packet/af_packet.c | 3 ++- 1 files changed, 2 insertions(+), 1 deletions(-) diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c index 3616f27..0856a13 100644 --- a/net/packet/af_packet.c +++ b/net/packet/af_packet.c @@ -1719,7 +1719,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, rcu_read_lock(); dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); if (dev) - strlcpy(uaddr->sa_data, dev->name, 15); + strncpy(uaddr->sa_data, dev->name, 14); else memset(uaddr->sa_data, 0, 14); rcu_read_unlock(); @@ -1742,6 +1742,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr, sll->sll_family = AF_PACKET; sll->sll_ifindex = po->ifindex; sll->sll_protocol = po->num; + sll->sll_pkttype = 0; rcu_read_lock(); dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex); if (dev) { -- 1.7.0.4 ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [PATCH 2/3] net: packet: fix information leak to userland 2010-10-31 17:10 [PATCH 2/3] net: packet: fix information leak to userland Vasiliy Kulikov @ 2010-11-01 9:14 ` walter harms 2010-11-06 14:39 ` Vasiliy Kulikov 0 siblings, 1 reply; 8+ messages in thread From: walter harms @ 2010-11-01 9:14 UTC (permalink / raw) To: Vasiliy Kulikov Cc: kernel-janitors, David S. Miller, Jiri Pirko, Eric Dumazet, netdev, linux-kernel Vasiliy Kulikov schrieb: > packet_getname_spkt() doesn't initialize all members of sa_data field of > sockaddr struct if strlen(dev->name) < 13. This structure is then copied > to userland. It leads to leaking of contents of kernel stack memory. > We have to fully fill sa_data with strncpy() instead of strlcpy(). > > The same with packet_getname(): it doesn't initialize sll_pkttype field of > sockaddr_ll. Set it to zero. > > Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> > --- > net/packet/af_packet.c | 3 ++- > 1 files changed, 2 insertions(+), 1 deletions(-) > > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c > index 3616f27..0856a13 100644 > --- a/net/packet/af_packet.c > +++ b/net/packet/af_packet.c > @@ -1719,7 +1719,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, > rcu_read_lock(); > dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); > if (dev) > - strlcpy(uaddr->sa_data, dev->name, 15); > + strncpy(uaddr->sa_data, dev->name, 14); > else > memset(uaddr->sa_data, 0, 14); if i understand the code correcly the max size for dev->name is IFNAMSIZ. You can simply that part: memset(uaddr->sa_data, 0, IFNAMSIZ); dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); if (dev) strlcpy(uaddr->sa_data, dev->name, IFNAMSIZ); you should send that as separate patch. re, wh > rcu_read_unlock(); > @@ -1742,6 +1742,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr, > sll->sll_family = AF_PACKET; > sll->sll_ifindex = po->ifindex; > sll->sll_protocol = po->num; > + sll->sll_pkttype = 0; > rcu_read_lock(); > dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex); > if (dev) { ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 2/3] net: packet: fix information leak to userland 2010-11-01 9:14 ` walter harms @ 2010-11-06 14:39 ` Vasiliy Kulikov 2010-11-07 11:37 ` walter harms 2010-11-10 18:16 ` Vasiliy Kulikov 0 siblings, 2 replies; 8+ messages in thread From: Vasiliy Kulikov @ 2010-11-06 14:39 UTC (permalink / raw) To: walter harms Cc: kernel-janitors, David S. Miller, Jiri Pirko, Eric Dumazet, netdev, linux-kernel On Mon, Nov 01, 2010 at 10:14 +0100, walter harms wrote: > > > Vasiliy Kulikov schrieb: > > packet_getname_spkt() doesn't initialize all members of sa_data field of > > sockaddr struct if strlen(dev->name) < 13. This structure is then copied > > to userland. It leads to leaking of contents of kernel stack memory. > > We have to fully fill sa_data with strncpy() instead of strlcpy(). > > > > The same with packet_getname(): it doesn't initialize sll_pkttype field of > > sockaddr_ll. Set it to zero. > > > > Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> > > --- > > net/packet/af_packet.c | 3 ++- > > 1 files changed, 2 insertions(+), 1 deletions(-) > > > > diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c > > index 3616f27..0856a13 100644 > > --- a/net/packet/af_packet.c > > +++ b/net/packet/af_packet.c > > @@ -1719,7 +1719,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, > > rcu_read_lock(); > > dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); > > if (dev) > > - strlcpy(uaddr->sa_data, dev->name, 15); > > + strncpy(uaddr->sa_data, dev->name, 14); > > else > > memset(uaddr->sa_data, 0, 14); > > if i understand the code correcly the max size for dev->name is IFNAMSIZ. For dev->name - IFNAMSIZ, for uaddr->sa_data - 14. > You can simply that part: > > memset(uaddr->sa_data, 0, IFNAMSIZ); > dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); > if (dev) > strlcpy(uaddr->sa_data, dev->name, IFNAMSIZ); This will overflow uaddr->sa_data. Also I don't see any difficulty to fill the array only once. > you should send that as separate patch. > re, > wh > > > > rcu_read_unlock(); > > @@ -1742,6 +1742,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr, > > sll->sll_family = AF_PACKET; > > sll->sll_ifindex = po->ifindex; > > sll->sll_protocol = po->num; > > + sll->sll_pkttype = 0; > > rcu_read_lock(); > > dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex); > > if (dev) { Thanks, -- Vasiliy ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 2/3] net: packet: fix information leak to userland 2010-11-06 14:39 ` Vasiliy Kulikov @ 2010-11-07 11:37 ` walter harms 2010-11-07 12:06 ` Vasiliy Kulikov 2010-11-10 18:16 ` Vasiliy Kulikov 1 sibling, 1 reply; 8+ messages in thread From: walter harms @ 2010-11-07 11:37 UTC (permalink / raw) To: Vasiliy Kulikov Cc: kernel-janitors, David S. Miller, Jiri Pirko, Eric Dumazet, netdev, linux-kernel Am 06.11.2010 15:39, schrieb Vasiliy Kulikov: > On Mon, Nov 01, 2010 at 10:14 +0100, walter harms wrote: >> >> >> Vasiliy Kulikov schrieb: >>> packet_getname_spkt() doesn't initialize all members of sa_data field of >>> sockaddr struct if strlen(dev->name) < 13. This structure is then copied >>> to userland. It leads to leaking of contents of kernel stack memory. >>> We have to fully fill sa_data with strncpy() instead of strlcpy(). >>> >>> The same with packet_getname(): it doesn't initialize sll_pkttype field of >>> sockaddr_ll. Set it to zero. >>> >>> Signed-off-by: Vasiliy Kulikov <segooon@gmail.com> >>> --- >>> net/packet/af_packet.c | 3 ++- >>> 1 files changed, 2 insertions(+), 1 deletions(-) >>> >>> diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c >>> index 3616f27..0856a13 100644 >>> --- a/net/packet/af_packet.c >>> +++ b/net/packet/af_packet.c >>> @@ -1719,7 +1719,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, >>> rcu_read_lock(); >>> dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); >>> if (dev) >>> - strlcpy(uaddr->sa_data, dev->name, 15); >>> + strncpy(uaddr->sa_data, dev->name, 14); >>> else >>> memset(uaddr->sa_data, 0, 14); >> >> if i understand the code correcly the max size for dev->name is IFNAMSIZ. > > For dev->name - IFNAMSIZ, for uaddr->sa_data - 14. > did not notice, since uaddr->sa_data should take dev->name this does no look very clever. How is the size of sa_data defined ? Would it hurt when some uses IFNAMSIZ here ? Perhaps someone who know more about the network stack can figure out what is actualy done with uaddr->sa_data. looks like a can of worms. In packet_bind_spkt() they will copy a char[15], obviously it is a real problem. re, wh >> You can simply that part: >> >> memset(uaddr->sa_data, 0, IFNAMSIZ); >> dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); >> if (dev) >> strlcpy(uaddr->sa_data, dev->name, IFNAMSIZ); > > This will overflow uaddr->sa_data. Also I don't see any difficulty to > fill the array only once. > >> you should send that as separate patch. >> re, >> wh >> >> >>> rcu_read_unlock(); >>> @@ -1742,6 +1742,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr, >>> sll->sll_family = AF_PACKET; >>> sll->sll_ifindex = po->ifindex; >>> sll->sll_protocol = po->num; >>> + sll->sll_pkttype = 0; >>> rcu_read_lock(); >>> dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex); >>> if (dev) { > > Thanks, > ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 2/3] net: packet: fix information leak to userland 2010-11-07 11:37 ` walter harms @ 2010-11-07 12:06 ` Vasiliy Kulikov 2010-11-07 12:56 ` walter harms 0 siblings, 1 reply; 8+ messages in thread From: Vasiliy Kulikov @ 2010-11-07 12:06 UTC (permalink / raw) To: walter harms Cc: kernel-janitors, David S. Miller, Jiri Pirko, Eric Dumazet, netdev, linux-kernel On Sun, Nov 07, 2010 at 12:37 +0100, walter harms wrote: > Am 06.11.2010 15:39, schrieb Vasiliy Kulikov: > > On Mon, Nov 01, 2010 at 10:14 +0100, walter harms wrote: > >> Vasiliy Kulikov schrieb: > >>> @@ -1719,7 +1719,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, > >>> rcu_read_lock(); > >>> dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); > >>> if (dev) > >>> - strlcpy(uaddr->sa_data, dev->name, 15); > >>> + strncpy(uaddr->sa_data, dev->name, 14); > >>> else > >>> memset(uaddr->sa_data, 0, 14); > >> > >> if i understand the code correcly the max size for dev->name is IFNAMSIZ. > > > > For dev->name - IFNAMSIZ, for uaddr->sa_data - 14. > > > > > did not notice, since uaddr->sa_data should take dev->name this does no look very > clever. How is the size of sa_data defined ? Magic size... ~/linux/include/linux/socket.h: struct sockaddr { sa_family_t sa_family; /* address family, AF_xxx */ char sa_data[14]; /* 14 bytes of protocol address */ }; > Would it hurt when some uses IFNAMSIZ here ? If copy _to_ sa_data string of maximum IFNAMSIZ bytes - yes. In packet_getname_spkt() the output buffer is 128 bytes, so it doesn't really overflows anything. I don't think that *_getname() implementations don't know this. > Perhaps someone who know more about the network stack can figure out what is actualy done > with uaddr->sa_data. Yeah, also I wonder whether it is always NULL-terminated string or not. > looks like a can of worms. > > > In packet_bind_spkt() they will copy a char[15], obviously it is a real problem. No, packet_bind_spkt() copies 14-byte string into array of 15 bytes. The vice versa would be a bug. > re, > wh > > > >> You can simply that part: > >> > >> memset(uaddr->sa_data, 0, IFNAMSIZ); > >> dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); > >> if (dev) > >> strlcpy(uaddr->sa_data, dev->name, IFNAMSIZ); > > > > This will overflow uaddr->sa_data. Also I don't see any difficulty to > > fill the array only once. > > > >> you should send that as separate patch. > >> re, > >> wh > >> > >> > >>> rcu_read_unlock(); > >>> @@ -1742,6 +1742,7 @@ static int packet_getname(struct socket *sock, struct sockaddr *uaddr, > >>> sll->sll_family = AF_PACKET; > >>> sll->sll_ifindex = po->ifindex; > >>> sll->sll_protocol = po->num; > >>> + sll->sll_pkttype = 0; > >>> rcu_read_lock(); > >>> dev = dev_get_by_index_rcu(sock_net(sk), po->ifindex); > >>> if (dev) { > > > > Thanks, > > -- Vasiliy ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 2/3] net: packet: fix information leak to userland 2010-11-07 12:06 ` Vasiliy Kulikov @ 2010-11-07 12:56 ` walter harms 0 siblings, 0 replies; 8+ messages in thread From: walter harms @ 2010-11-07 12:56 UTC (permalink / raw) To: Vasiliy Kulikov Cc: kernel-janitors, David S. Miller, Jiri Pirko, Eric Dumazet, netdev, linux-kernel Am 07.11.2010 13:06, schrieb Vasiliy Kulikov: > On Sun, Nov 07, 2010 at 12:37 +0100, walter harms wrote: >> Am 06.11.2010 15:39, schrieb Vasiliy Kulikov: >>> On Mon, Nov 01, 2010 at 10:14 +0100, walter harms wrote: >>>> Vasiliy Kulikov schrieb: >>>>> @@ -1719,7 +1719,7 @@ static int packet_getname_spkt(struct socket *sock, struct sockaddr *uaddr, >>>>> rcu_read_lock(); >>>>> dev = dev_get_by_index_rcu(sock_net(sk), pkt_sk(sk)->ifindex); >>>>> if (dev) >>>>> - strlcpy(uaddr->sa_data, dev->name, 15); >>>>> + strncpy(uaddr->sa_data, dev->name, 14); >>>>> else >>>>> memset(uaddr->sa_data, 0, 14); >>>> >>>> if i understand the code correcly the max size for dev->name is IFNAMSIZ. >>> >>> For dev->name - IFNAMSIZ, for uaddr->sa_data - 14. >>> >> >> >> did not notice, since uaddr->sa_data should take dev->name this does no look very >> clever. How is the size of sa_data defined ? > > Magic size... > > ~/linux/include/linux/socket.h: > > struct sockaddr { > sa_family_t sa_family; /* address family, AF_xxx */ > char sa_data[14]; /* 14 bytes of protocol address */ > }; > > >> Would it hurt when some uses IFNAMSIZ here ? > so i should be more direct. the idea was : char sa_data[IFNAMSIZ]; > If copy _to_ sa_data string of maximum IFNAMSIZ bytes - yes. > > > In packet_getname_spkt() the output buffer is 128 bytes, so it doesn't > really overflows anything. I don't think that *_getname() implementations > don't know this. > >> Perhaps someone who know more about the network stack can figure out what is actualy done >> with uaddr->sa_data. > > Yeah, also I wonder whether it is always NULL-terminated string or not. > >> looks like a can of worms. >> >> >> In packet_bind_spkt() they will copy a char[15], obviously it is a real problem. > > No, packet_bind_spkt() copies 14-byte string into array of 15 bytes. > The vice versa would be a bug. > ups your are right, wrong way around. it still does not look clever. I have the feeling that the basic idea what to store the string with out \0. according to this: http://www.gnu.org/s/libc/manual/html_node/Address-Formats.html It should work. re, wh ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 2/3] net: packet: fix information leak to userland 2010-11-06 14:39 ` Vasiliy Kulikov 2010-11-07 11:37 ` walter harms @ 2010-11-10 18:16 ` Vasiliy Kulikov 2010-11-10 18:20 ` David Miller 1 sibling, 1 reply; 8+ messages in thread From: Vasiliy Kulikov @ 2010-11-10 18:16 UTC (permalink / raw) To: walter harms Cc: kernel-janitors, David S. Miller, Jiri Pirko, Eric Dumazet, netdev, linux-kernel David, Are there any other suggestions about this patch? Thanks, -- Vasiliy ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [PATCH 2/3] net: packet: fix information leak to userland 2010-11-10 18:16 ` Vasiliy Kulikov @ 2010-11-10 18:20 ` David Miller 0 siblings, 0 replies; 8+ messages in thread From: David Miller @ 2010-11-10 18:20 UTC (permalink / raw) To: segooon; +Cc: wharms, kernel-janitors, jpirko, eric.dumazet, netdev, linux-kernel From: Vasiliy Kulikov <segooon@gmail.com> Date: Wed, 10 Nov 2010 21:16:42 +0300 > Are there any other suggestions about this patch? None from me, so even if there are no changes please just repost this. Thanks. ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2010-11-10 18:19 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2010-10-31 17:10 [PATCH 2/3] net: packet: fix information leak to userland Vasiliy Kulikov 2010-11-01 9:14 ` walter harms 2010-11-06 14:39 ` Vasiliy Kulikov 2010-11-07 11:37 ` walter harms 2010-11-07 12:06 ` Vasiliy Kulikov 2010-11-07 12:56 ` walter harms 2010-11-10 18:16 ` Vasiliy Kulikov 2010-11-10 18:20 ` David Miller
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).