From: Sasha Levin <sashal@kernel.org>
To: Zubin Mithra <zsm@chromium.org>
Cc: stable@vger.kernel.org, gregkh@linuxfoundation.org,
groeck@chromium.org, jannh@google.com, pablo@netfilter.org
Subject: Re: [v4.9.y, v4.4.y] netfilter: xt_bpf: add overflow checks
Date: Thu, 27 Feb 2020 20:35:42 -0500 [thread overview]
Message-ID: <20200228013542.GH22178@sasha-vm> (raw)
In-Reply-To: <20200226213501.113484-1-zsm@chromium.org>
On Wed, Feb 26, 2020 at 01:35:01PM -0800, Zubin Mithra wrote:
>From: Jann Horn <jannh@google.com>
>
>[ Upstream commit 6ab405114b0b229151ef06f4e31c7834dd09d0c0 ]
>
>Check whether inputs from userspace are too long (explicit length field too
>big or string not null-terminated) to avoid out-of-bounds reads.
>
>As far as I can tell, this can at worst lead to very limited kernel heap
>memory disclosure or oopses.
>
>This bug can be triggered by an unprivileged user even if the xt_bpf module
>is not loaded: iptables is available in network namespaces, and the xt_bpf
>module can be autoloaded.
>
>Triggering the bug with a classic BPF filter with fake length 0x1000 causes
>the following KASAN report:
>
>==================================================================
>BUG: KASAN: slab-out-of-bounds in bpf_prog_create+0x84/0xf0
>Read of size 32768 at addr ffff8801eff2c494 by task test/4627
>
>CPU: 0 PID: 4627 Comm: test Not tainted 4.15.0-rc1+ #1
>[...]
>Call Trace:
> dump_stack+0x5c/0x85
> print_address_description+0x6a/0x260
> kasan_report+0x254/0x370
> ? bpf_prog_create+0x84/0xf0
> memcpy+0x1f/0x50
> bpf_prog_create+0x84/0xf0
> bpf_mt_check+0x90/0xd6 [xt_bpf]
>[...]
>Allocated by task 4627:
> kasan_kmalloc+0xa0/0xd0
> __kmalloc_node+0x47/0x60
> xt_alloc_table_info+0x41/0x70 [x_tables]
>[...]
>The buggy address belongs to the object at ffff8801eff2c3c0
> which belongs to the cache kmalloc-2048 of size 2048
>The buggy address is located 212 bytes inside of
> 2048-byte region [ffff8801eff2c3c0, ffff8801eff2cbc0)
>[...]
>==================================================================
>
>Fixes: e6f30c731718 ("netfilter: x_tables: add xt_bpf match")
>Signed-off-by: Jann Horn <jannh@google.com>
>Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
>Signed-off-by: Zubin Mithra <zsm@chromium.org>
Queued up for 4.9 and 4.4, thanks!
--
Thanks,
Sasha
prev parent reply other threads:[~2020-02-28 1:35 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-02-26 21:35 [v4.9.y, v4.4.y] netfilter: xt_bpf: add overflow checks Zubin Mithra
2020-02-28 1:35 ` Sasha Levin [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200228013542.GH22178@sasha-vm \
--to=sashal@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=groeck@chromium.org \
--cc=jannh@google.com \
--cc=pablo@netfilter.org \
--cc=stable@vger.kernel.org \
--cc=zsm@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox