[lkml]   [2012]   [Mar]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[34-longterm 040/196] netfilter: ipt_CLUSTERIP: fix buffer overflow
    From: Vasiliy Kulikov <>

    This is a commit scheduled for the next v2.6.34 longterm release.
    If you see a problem with using this for longterm, please comment.

    commit 961ed183a9fd080cf306c659b8736007e44065a5 upstream.

    'buffer' string is copied from userspace. It is not checked whether it is
    zero terminated. This may lead to overflow inside of simple_strtoul().
    Changli Gao suggested to copy not more than user supplied 'size' bytes.

    It was introduced before the git epoch. Files "ipt_CLUSTERIP/*" are
    root writable only by default, however, on some setups permissions might be
    relaxed to e.g. network admin user.

    Signed-off-by: Vasiliy Kulikov <>
    Acked-by: Changli Gao <>
    Signed-off-by: Patrick McHardy <>
    Signed-off-by: Paul Gortmaker <>
    net/ipv4/netfilter/ipt_CLUSTERIP.c | 5 ++++-
    1 file changed, 4 insertions(+), 1 deletion(-)

    diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
    index ab82840..e8bd977 100644
    --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
    +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
    @@ -663,8 +663,11 @@ static ssize_t clusterip_proc_write(struct file *file, const char __user *input,
    char buffer[PROC_WRITELEN+1];
    unsigned long nodenum;

    - if (copy_from_user(buffer, input, PROC_WRITELEN))
    + if (size > PROC_WRITELEN)
    + return -EIO;
    + if (copy_from_user(buffer, input, size))
    return -EFAULT;
    + buffer[size] = 0;

    if (*buffer == '+') {
    nodenum = simple_strtoul(buffer+1, NULL, 10);

     \ /
      Last update: 2012-03-13 01:21    [W:0.019 / U:11.464 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site