RE: [PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOCAL_AUTH_CHUNKS

[JEAN Jeremy <Jeremy.Jean@ssi.gouv.fr>]

Thanks for your valuable feedbacks.
I updated the patch, and sent it to the list.
https://lore.kernel.org/netdev/20260804200042.2412009-1-Jeremy.Jean@oss.cyber.gouv.fr/

Regards,
Jérémy

-----Message d'origine-----
De : Xin Long <lucien.xin@gmail.com>
Envoyé : mardi 4 août 2026 16:56
À : JEAN Jeremy <Jeremy.Jean@ssi.gouv.fr>
Cc : Jun Yang <juny24602@gmail.com>; netdev@vger.kernel.org; Jun Yang <junvyyang@tencent.com>; stable@kernel.org; TencentOS Corvus AI <corvus@tencent.com>; Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>; David S. Miller <davem@davemloft.net>; Eric Dumazet <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>; Simon Horman <horms@kernel.org>; Vlad Yasevich <vladislav.yasevich@hp.com>; linux-sctp@vger.kernel.org; linux-kernel@vger.kernel.org
Objet : Re: [PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOCAL_AUTH_CHUNKS

On Fri, Jul 31, 2026 at 3:48 PM JEAN Jeremy <Jeremy.Jean@ssi.gouv.fr> wrote:
>
> Dear all,
>
> Attached is a proposed fix that relies on a code suggestion from Xin Long, but reworked to better handle all cases.
> Does this look ok?
> I verified experimentally on 8ba098e6b6ff that this fix solves the two bugs I reported.
>

Hi, JEAN,

I think the fix only needs to add sctp_auth_verify_cookie_params() and call it from sctp_unpack_cookie().  Since the reported issues are caused by tampering with the cookie auth parameters, I don't think the other changes in net/sctp/auth.c and net/sctp/sm_statefuns.c are necessary. Could you please confirm?

Also, you may consider renaming it to sctp_auth_chunk_id_forbidden(), so it can be reused later to replace the existing open-coded checks in
sctp_setsockopt_auth_chunk() and __sctp_auth_cid() in a separate patch.

Nit: In sctp_auth_verify_cookie_params(), too many lines for these u16 variable, please merge them into 1 or 2 lines, like:

u16 hmacs_len, chunks_len;
u16 n_hmacs, n_chunks, i;
bool has_sha1 = false;

With all the above comments addressed, please send the next patch to:

# ./scripts/get_
get_dvb_firmware   get_maintainer.pl
[root@wsfd-netdev64 net-next]# ./scripts/get_maintainer.pl net/sctp/auth.c Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> (maintainer:SCTP PROTOCOL) Xin Long <lucien.xin@gmail.com> (maintainer:SCTP PROTOCOL) "David S. Miller" <davem@davemloft.net> (maintainer:NETWORKING [GENERAL]) Eric Dumazet <edumazet@google.com> (maintainer:NETWORKING [GENERAL]) Jakub Kicinski <kuba@kernel.org> (maintainer:NETWORKING [GENERAL]) Paolo Abeni <pabeni@redhat.com> (maintainer:NETWORKING [GENERAL]) Simon Horman <horms@kernel.org> (reviewer:NETWORKING [GENERAL]) linux-sctp@vger.kernel.org (open list:SCTP PROTOCOL) netdev@vger.kernel.org (open list:NETWORKING [GENERAL]) linux-kernel@vger.kernel.org (open list)

Thanks.

> Regards,
> Jérémy
>
> -----Message d'origine-----
> De : Xin Long <lucien.xin@gmail.com>
> Envoyé : vendredi 31 juillet 2026 17:27 À : Jun Yang
> <juny24602@gmail.com>; JEAN Jeremy <Jeremy.Jean@ssi.gouv.fr> Cc :
> netdev@vger.kernel.org; Jun Yang <junvyyang@tencent.com>;
> stable@kernel.org; TencentOS Corvus AI <corvus@tencent.com>; Marcelo
> Ricardo Leitner <marcelo.leitner@gmail.com>; David S. Miller
> <davem@davemloft.net>; Eric Dumazet <edumazet@google.com>; Jakub
> Kicinski <kuba@kernel.org>; Paolo Abeni <pabeni@redhat.com>; Simon
> Horman <horms@kernel.org>; Vlad Yasevich <vladislav.yasevich@hp.com>;
> linux-sctp@vger.kernel.org; linux-kernel@vger.kernel.org Objet : Re:
> [PATCH net] sctp: bound the auth_chunks copy length in
> SCTP_LOCAL_AUTH_CHUNKS
>
> On Thu, Jul 30, 2026 at 5:02 AM Jun Yang <juny24602@gmail.com> wrote:
> >
> > From: Jun Yang <junvyyang@tencent.com>
> >
> > sctp_getsockopt_local_auth_chunks() copies ntohs(length) -
> > sizeof(paramhdr) bytes out of ch->chunks without bounding the count.
> > For an association ch is the fixed-size asoc->c.auth_chunks[] array
> > (sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS bytes), whose
> > length field is restored from the received state cookie by
> > sctp_unpack_cookie() and is not validated against the array size.  A
> > cookie carrying an oversized length makes copy_to_user() read past
> > the array (out-of-bounds read).
> >
> > Bound the chunk count to SCTP_AUTH_MAX_CHUNKS before the copy.  That
> > is the most valid chunk bytes either source can hold, so legitimate
> > output is unchanged, and it also covers a stored length smaller than
> > the parameter header, which would otherwise underflow.
> >
> > Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH
> > extensions.")
> > Cc: stable@kernel.org
> > Reported-by: TencentOS Corvus AI <corvus@tencent.com>
> > Signed-off-by: Jun Yang <junvyyang@tencent.com>
> > ---
> >  net/sctp/socket.c | 6 ++++++
> >  1 file changed, 6 insertions(+)
> >
> > diff --git a/net/sctp/socket.c b/net/sctp/socket.c index
> > 9a6da4e0d741..3e9dacb772a0 100644
> > --- a/net/sctp/socket.c
> > +++ b/net/sctp/socket.c
> > @@ -7109,6 +7109,12 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
> >                 goto num;
> >
> >         num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct
> > sctp_paramhdr);
> > +       /* asoc->c.auth_chunks[] holds at most SCTP_AUTH_MAX_CHUNKS bytes but its
> > +        * length is restored from the state cookie and is not bounded here;
> > +        * clamp so an oversized length cannot read past the array.
> > +        */
> > +       if (num_chunks > SCTP_AUTH_MAX_CHUNKS)
> > +               num_chunks = SCTP_AUTH_MAX_CHUNKS;
> >         if (len < sizeof(struct sctp_authchunks) + num_chunks)
> >                 return -EINVAL;
> >
> > --
> > 2.55.0
> >
> The issue requires sysctl net.sctp.cookie_hmac_alg=none, right?
>
> If so, Jean Jeremy has reported two issues caused by the missing validation of the auth params in the cookie. We may need to validate all auth_random, auth_hmacs and auth_chunks in sctp_unpack_cookie().
>
> Let's wait a bit and see if he proceeds with the fix I've suggested.
>
> Thanks.
> Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d’exécution d’une relation professionnelle et s’opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter contact.rgpd@sgdsn.gouv.fr. Si vous avez reçu ce message par erreur, nous vous remercions d’en informer l’expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: contact.rgpd@sgdsn.gouv.fr. If you have received this message in error, we thank you for informing the sender and destroying the message.
Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d’exécution d’une relation professionnelle et s’opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter contact.rgpd@sgdsn.gouv.fr. Si vous avez reçu ce message par erreur, nous vous remercions d’en informer l’expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: contact.rgpd@sgdsn.gouv.fr. If you have received this message in error, we thank you for informing the sender and destroying the message.