lkml.org 
[lkml]   [2018]   [Jan]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH AUTOSEL for 4.14 087/100] xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
    Date
    From: Steffen Klassert <steffen.klassert@secunet.com>

    [ Upstream commit 732706afe1cc46ef48493b3d2b69c98f36314ae4 ]

    On policies with a transport mode template, we pass the addresses
    from the flowi to xfrm_state_find(), assuming that the IP addresses
    (and address family) don't change during transformation.

    Unfortunately our policy template validation is not strict enough.
    It is possible to configure policies with transport mode template
    where the address family of the template does not match the selectors
    address family. This lead to stack-out-of-bound reads because
    we compare arddesses of the wrong family. Fix this by refusing
    such a configuration, address family can not change on transport
    mode.

    We use the assumption that, on transport mode, the first templates
    address family must match the address family of the policy selector.
    Subsequent transport mode templates must mach the address family of
    the previous template.

    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    ---
    net/xfrm/xfrm_user.c | 9 +++++++++
    1 file changed, 9 insertions(+)

    diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
    index e44a0fed48dd..30a6dc9ad078 100644
    --- a/net/xfrm/xfrm_user.c
    +++ b/net/xfrm/xfrm_user.c
    @@ -1417,11 +1417,14 @@ static void copy_templates(struct xfrm_policy *xp, struct xfrm_user_tmpl *ut,

    static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
    {
    + u16 prev_family;
    int i;

    if (nr > XFRM_MAX_DEPTH)
    return -EINVAL;

    + prev_family = family;
    +
    for (i = 0; i < nr; i++) {
    /* We never validated the ut->family value, so many
    * applications simply leave it at zero. The check was
    @@ -1433,6 +1436,12 @@ static int validate_tmpl(int nr, struct xfrm_user_tmpl *ut, u16 family)
    if (!ut[i].family)
    ut[i].family = family;

    + if ((ut[i].mode == XFRM_MODE_TRANSPORT) &&
    + (ut[i].family != prev_family))
    + return -EINVAL;
    +
    + prev_family = ut[i].family;
    +
    switch (ut[i].family) {
    case AF_INET:
    break;
    --
    2.11.0
    \
     
     \ /
      Last update: 2018-01-28 23:28    [W:4.209 / U:25.748 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site