* [PATCH net] net: flow_dissector: fail on evil iph->ihl
@ 2013-11-01 7:01 Jason Wang
2013-11-01 9:48 ` Eric Dumazet
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Jason Wang @ 2013-11-01 7:01 UTC (permalink / raw)
To: davem, edumazet, netdev, linux-kernel
Cc: Jason Wang, Petr Matousek, Michael S. Tsirkin, Daniel Borkmann
We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
is evil (less than 5).
This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
(rps: support IPIP encapsulation).
Cc: Eric Dumazet <edumazet@google.com>
Cc: Petr Matousek <pmatouse@redhat.com>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Daniel Borkmann <dborkman@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
This patch is needed for stable.
---
net/core/flow_dissector.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 8d7d0dd..143b6fd 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -40,7 +40,7 @@ again:
struct iphdr _iph;
ip:
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
- if (!iph)
+ if (!iph || iph->ihl < 5)
return false;
if (ip_is_fragment(iph))
--
1.8.1.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: flow_dissector: fail on evil iph->ihl
2013-11-01 7:01 [PATCH net] net: flow_dissector: fail on evil iph->ihl Jason Wang
@ 2013-11-01 9:48 ` Eric Dumazet
2013-11-01 16:29 ` Ben Hutchings
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Eric Dumazet @ 2013-11-01 9:48 UTC (permalink / raw)
To: Jason Wang
Cc: davem, edumazet, netdev, linux-kernel, Petr Matousek,
Michael S. Tsirkin, Daniel Borkmann
On Fri, 2013-11-01 at 15:01 +0800, Jason Wang wrote:
> We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
> skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
> is evil (less than 5).
>
> This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
> (rps: support IPIP encapsulation).
>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Petr Matousek <pmatouse@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Daniel Borkmann <dborkman@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
> This patch is needed for stable.
> ---
Acked-by: Eric Dumazet <edumazet@google.com>
Thanks Jason !
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: flow_dissector: fail on evil iph->ihl
2013-11-01 7:01 [PATCH net] net: flow_dissector: fail on evil iph->ihl Jason Wang
2013-11-01 9:48 ` Eric Dumazet
@ 2013-11-01 16:29 ` Ben Hutchings
2013-11-02 6:16 ` David Miller
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Ben Hutchings @ 2013-11-01 16:29 UTC (permalink / raw)
To: Jason Wang
Cc: davem, edumazet, netdev, linux-kernel, Petr Matousek,
Michael S. Tsirkin, Daniel Borkmann
On Fri, 2013-11-01 at 15:01 +0800, Jason Wang wrote:
> We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
> skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
> is evil (less than 5).
>
> This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
> (rps: support IPIP encapsulation).
It would be helpful to include the CVE ID here:
CVE-2013-4348
Ben.
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Petr Matousek <pmatouse@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Daniel Borkmann <dborkman@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
> This patch is needed for stable.
> ---
> net/core/flow_dissector.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
> index 8d7d0dd..143b6fd 100644
> --- a/net/core/flow_dissector.c
> +++ b/net/core/flow_dissector.c
> @@ -40,7 +40,7 @@ again:
> struct iphdr _iph;
> ip:
> iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
> - if (!iph)
> + if (!iph || iph->ihl < 5)
> return false;
>
> if (ip_is_fragment(iph))
--
Ben Hutchings, Staff Engineer, Solarflare
Not speaking for my employer; that's the marketing department's job.
They asked us to note that Solarflare product names are trademarked.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: flow_dissector: fail on evil iph->ihl
2013-11-01 7:01 [PATCH net] net: flow_dissector: fail on evil iph->ihl Jason Wang
2013-11-01 9:48 ` Eric Dumazet
2013-11-01 16:29 ` Ben Hutchings
@ 2013-11-02 6:16 ` David Miller
2013-11-02 20:22 ` Michael S. Tsirkin
2013-11-03 22:18 ` Daniel Borkmann
4 siblings, 0 replies; 6+ messages in thread
From: David Miller @ 2013-11-02 6:16 UTC (permalink / raw)
To: jasowang; +Cc: edumazet, netdev, linux-kernel, pmatouse, mst, dborkman
From: Jason Wang <jasowang@redhat.com>
Date: Fri, 1 Nov 2013 15:01:10 +0800
> We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
> skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
> is evil (less than 5).
>
> This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
> (rps: support IPIP encapsulation).
>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Petr Matousek <pmatouse@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Daniel Borkmann <dborkman@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
Applied and queued up for -stable, thanks Jason.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: flow_dissector: fail on evil iph->ihl
2013-11-01 7:01 [PATCH net] net: flow_dissector: fail on evil iph->ihl Jason Wang
` (2 preceding siblings ...)
2013-11-02 6:16 ` David Miller
@ 2013-11-02 20:22 ` Michael S. Tsirkin
2013-11-03 22:18 ` Daniel Borkmann
4 siblings, 0 replies; 6+ messages in thread
From: Michael S. Tsirkin @ 2013-11-02 20:22 UTC (permalink / raw)
To: Jason Wang
Cc: davem, edumazet, netdev, linux-kernel, Petr Matousek,
Daniel Borkmann
On Fri, Nov 01, 2013 at 03:01:10PM +0800, Jason Wang wrote:
> We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
> skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
> is evil (less than 5).
>
> This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
> (rps: support IPIP encapsulation).
>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Petr Matousek <pmatouse@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Daniel Borkmann <dborkman@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
> ---
> This patch is needed for stable.
> ---
> net/core/flow_dissector.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
> index 8d7d0dd..143b6fd 100644
> --- a/net/core/flow_dissector.c
> +++ b/net/core/flow_dissector.c
> @@ -40,7 +40,7 @@ again:
> struct iphdr _iph;
> ip:
> iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
> - if (!iph)
> + if (!iph || iph->ihl < 5)
> return false;
>
> if (ip_is_fragment(iph))
> --
> 1.8.1.2
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH net] net: flow_dissector: fail on evil iph->ihl
2013-11-01 7:01 [PATCH net] net: flow_dissector: fail on evil iph->ihl Jason Wang
` (3 preceding siblings ...)
2013-11-02 20:22 ` Michael S. Tsirkin
@ 2013-11-03 22:18 ` Daniel Borkmann
4 siblings, 0 replies; 6+ messages in thread
From: Daniel Borkmann @ 2013-11-03 22:18 UTC (permalink / raw)
To: Jason Wang
Cc: davem, edumazet, netdev, linux-kernel, Petr Matousek,
Michael S. Tsirkin
On 11/01/2013 08:01 AM, Jason Wang wrote:
> We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
> skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
> is evil (less than 5).
>
> This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
> (rps: support IPIP encapsulation).
>
> Cc: Eric Dumazet <edumazet@google.com>
> Cc: Petr Matousek <pmatouse@redhat.com>
> Cc: Michael S. Tsirkin <mst@redhat.com>
> Cc: Daniel Borkmann <dborkman@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
Sorry, a bit late as I was offline last 4 days, but fwiw:
Acked-by: Daniel Borkmann <dborkman@redhat.com>
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2013-11-03 22:18 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2013-11-01 7:01 [PATCH net] net: flow_dissector: fail on evil iph->ihl Jason Wang
2013-11-01 9:48 ` Eric Dumazet
2013-11-01 16:29 ` Ben Hutchings
2013-11-02 6:16 ` David Miller
2013-11-02 20:22 ` Michael S. Tsirkin
2013-11-03 22:18 ` Daniel Borkmann
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).