[PATCH 0/3] net: fix three security bugs in NET/ROM and ROSE stacks

[PATCH 0/3] net: fix three security bugs in NET/ROM and ROSE stacks

[Mashiro Chen]

This series fixes three bugs in the Linux kernel AX.25 protocol stack,
submitted on top of Greg Kroah-Hartman's frame-size validation series
(https://lore.kernel.org/r/2026040730-untagged-groin-bbb7@gregkh).

Patch 1 fixes an integer overflow in nr_queue_rx_frame(): nr_sock.fraglen
is declared as unsigned short and accumulates received fragment lengths
without overflow protection.  When total received data exceeds 65535 bytes,
fraglen wraps to a small value, causing alloc_skb() to allocate a tiny
buffer followed by a full-length copy -- a heap out-of-bounds write.

Patch 2 fixes nr_find_socket() dispatching incoming NR_INFO frames by
matching only the circuit index/id bytes without validating the source
callsign against the socket's dest_addr.  Any node can inject frames into
an existing STATE_3 connection by guessing the circuit ID (the value space
is only 65025 non-zero pairs and IDs are assigned sequentially).  Combined
with the fraglen overflow in patch 1, this gives an unauthenticated
attacker a complete heap corruption primitive.

Patch 3 fixes an out-of-bounds read in rose_parse_ccitt(): the function
validates 10 <= l <= 20 but never checks that the remaining buffer is at
least l+2 bytes before calling memcpy().  rose_parse_national() already
performs the equivalent check; this patch adds the same guard.

Mashiro Chen (3):
  net: netrom: fix integer overflow in nr_queue_rx_frame()
  net: netrom: validate source address in nr_find_socket()
  net: rose: fix out-of-bounds read in rose_parse_ccitt()

 net/netrom/af_netrom.c | 11 +++++++----
 net/netrom/nr_in.c     | 10 ++++++++++
 net/rose/rose_subr.c   |  3 +++
 3 files changed, 20 insertions(+), 4 deletions(-)

-- 
2.53.0

[PATCH 1/3] net: netrom: fix integer overflow in nr_queue_rx_frame()

[Mashiro Chen]

nr_sock.fraglen is declared as unsigned short, so accumulating
received fragment lengths via

    nr->fraglen += skb->len;

can silently wrap around to a small value once the total exceeds
65535 bytes. When the final fragment arrives (NR_MORE_FLAG clear),
the wrapped fraglen is passed to alloc_skb(), which allocates an
undersized buffer. The subsequent skb_put() and skb_copy_from_linear_data()
loop then writes the actual full data into it, resulting in a heap
buffer overflow.

An attacker with NR_STATE_3 access (i.e. after completing a NET/ROM
connection handshake, which open BBS/node services allow to any
callsign) can trigger this by sending a stream of NR_INFO frames
with the MORE flag set until fraglen wraps, followed by a final
NR_INFO frame.

Fix by checking whether adding the incoming skb's length to the
accumulated fraglen would exceed USHRT_MAX before each accumulation.
If so, purge the fragment queue, reset fraglen, and return an error
to signal receive-busy to the caller.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org>
---
 net/netrom/nr_in.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/netrom/nr_in.c b/net/netrom/nr_in.c
index 97944db6b5ac6..0b7cdb99ae501 100644
--- a/net/netrom/nr_in.c
+++ b/net/netrom/nr_in.c
@@ -36,12 +36,22 @@ static int nr_queue_rx_frame(struct sock *sk, struct sk_buff *skb, int more)
 	nr_start_idletimer(sk);
 
 	if (more) {
+		if ((unsigned int)nr->fraglen + skb->len > USHRT_MAX) {
+			skb_queue_purge(&nr->frag_queue);
+			nr->fraglen = 0;
+			return 1;
+		}
 		nr->fraglen += skb->len;
 		skb_queue_tail(&nr->frag_queue, skb);
 		return 0;
 	}
 
 	if (!more && nr->fraglen > 0) {	/* End of fragment */
+		if ((unsigned int)nr->fraglen + skb->len > USHRT_MAX) {
+			skb_queue_purge(&nr->frag_queue);
+			nr->fraglen = 0;
+			return 1;
+		}
 		nr->fraglen += skb->len;
 		skb_queue_tail(&nr->frag_queue, skb);
 
-- 
2.53.0

[PATCH 2/3] net: netrom: validate source address in nr_find_socket()

[Mashiro Chen]

nr_find_socket() dispatches incoming NR_INFO frames into a connected
socket by matching the frame's circuit index/id pair (bytes[15-16])
against the socket's my_index/my_id.  It performs no validation of
the frame's source callsign against the socket's dest_addr.

This means any node on the network can craft an NR_INFO frame with
a guessed or brute-forced circuit index/id pair and have it accepted
into an arbitrary STATE_3 connection as if it came from the legitimate
peer.  Circuit IDs are assigned sequentially starting at (1,1), making
them predictable in practice.

This is exploited in concert with CVE-XXXX-XXXXX (nr_queue_rx_frame
fraglen overflow): an attacker can inject NR_INFO | NR_MORE_FLAG frames
into an existing connection without owning a connection themselves,
driving the victim socket's fraglen to wrap and triggering the heap
overflow entirely unauthenticated (CVSS PR:N).

Fix by adding a source address parameter to nr_find_socket() and
requiring it to match the socket's recorded dest_addr for all
frame-dispatch lookups.  The internal nr_find_next_circuit() caller,
which only checks for circuit ID availability, passes NULL to skip
the source check.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org>
---
 net/netrom/af_netrom.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c
index b605891bf86e4..73742cc9e9e42 100644
--- a/net/netrom/af_netrom.c
+++ b/net/netrom/af_netrom.c
@@ -162,7 +162,8 @@ static struct sock *nr_find_listener(ax25_address *addr)
 /*
  *	Find a connected NET/ROM socket given my circuit IDs.
  */
-static struct sock *nr_find_socket(unsigned char index, unsigned char id)
+static struct sock *nr_find_socket(unsigned char index, unsigned char id,
+				   const ax25_address *src)
 {
 	struct sock *s;
 
@@ -170,7 +171,8 @@ static struct sock *nr_find_socket(unsigned char index, unsigned char id)
 	sk_for_each(s, &nr_list) {
 		struct nr_sock *nr = nr_sk(s);
 
-		if (nr->my_index == index && nr->my_id == id) {
+		if (nr->my_index == index && nr->my_id == id &&
+		    (!src || !ax25cmp(&nr->dest_addr, src))) {
 			sock_hold(s);
 			goto found;
 		}
@@ -219,7 +221,8 @@ static unsigned short nr_find_next_circuit(void)
 		j = id % 256;
 
 		if (i != 0 && j != 0) {
-			if ((sk=nr_find_socket(i, j)) == NULL)
+			sk = nr_find_socket(i, j, NULL);
+			if (!sk)
 				break;
 			sock_put(sk);
 		}
@@ -926,7 +929,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev)
 		if (frametype == NR_CONNREQ)
 			sk = nr_find_peer(circuit_index, circuit_id, src);
 		else
-			sk = nr_find_socket(circuit_index, circuit_id);
+			sk = nr_find_socket(circuit_index, circuit_id, src);
 	}
 
 	if (sk != NULL) {
-- 
2.53.0

[PATCH 3/3] net: rose: fix out-of-bounds read in rose_parse_ccitt()

[Mashiro Chen]

rose_parse_ccitt() handles 0xC0-class facilities by reading l = p[1]
and validating 10 <= l <= 20, but never checks whether the remaining
buffer actually contains l + 2 bytes before accessing p + 7 and
p + 12 via memcpy().

An attacker can send a ROSE_CALL_REQUEST frame with a crafted CCITT
facility whose declared length fits the 10-20 range but whose actual
data is truncated. This causes the kernel to read up to l + 2 bytes
beyond the end of the facilities field, leaking adjacent skb data.

By contrast, rose_parse_national() already performs the equivalent
check (if (len < 2 + l) return -1) for all its 0xC0-class cases.

Add the same check to rose_parse_ccitt() before any data access.

Fixes: e0bccd315db0 ("rose: Add length checks to CALL_REQUEST parsing")
Cc: stable@vger.kernel.org
Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org>
---
 net/rose/rose_subr.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/rose/rose_subr.c b/net/rose/rose_subr.c
index 4dbc437a9e229..a902ddeddc5bd 100644
--- a/net/rose/rose_subr.c
+++ b/net/rose/rose_subr.c
@@ -370,6 +370,9 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac
 			if (l < 10 || l > 20)
 				return -1;
 
+			if (len < 2 + l)
+				return -1;
+
 			if (*p == FAC_CCITT_DEST_NSAP) {
 				memcpy(&facilities->source_addr, p + 7, ROSE_ADDR_LEN);
 				memcpy(callsign, p + 12,   l - 10);
-- 
2.53.0