Messages in this thread Patch in this message | | | Date | Tue, 14 Dec 1999 23:34:30 +0100 (CET) | From | Andrea Arcangeli <> | Subject | Re: [security] Big problem on 2.0.x? (fwd) |
| |
On Mon, 13 Dec 1999, Andrei Pelinescu-Onciul wrote:
>I didn't look in 2.0.38 yet but in 2.0.36 the problem is in net/ipv4/ip_output.c in ip_build_xmit. >Here a short int (length) is used to compute the length of the ip packet. At first length contains the length of the packet without the header, then the ip header >length is added: > >if (!sk->ip_hdrincl) { > length += sizeof(struct iphdr); > if(opt) length += opt->optlen; > } > >ping -s 65468 -R generates a packet that looks like: > >ip header: 20 bytes >ip options: 40 bytes >icmp header: 8 bytes >icmp data: 65468 bytes > >If you add all this up you obtain 65536, but length is a short int so length will be 0!
Agreed. Your detection of the problem is correct IMHO.
>A quick way to fix this bug is to add the following if, after the one above: > > if (length < 20){ > printk("<1> ip_build_xmit: ERROR: packet too big! " > "dropping...\n"); > return -EPERM; > }
I looked at this too and I think your fix is very near to be the right one. The basics of your changes are right IMO.
I fixed this by checking that the payload is not too big in the case we have to include in the packet also some ip option. If it's too big I tell to userspace it's too big. This is my version:
diff -urN 2.0.38/net/ipv4/ip_output.c 2.0.38-ping-R/net/ipv4/ip_output.c --- 2.0.38/net/ipv4/ip_output.c Thu Jun 18 23:48:22 1998 +++ 2.0.38-ping-R/net/ipv4/ip_output.c Tue Dec 14 23:02:43 1999 @@ -703,7 +703,13 @@ if (!sk->ip_hdrincl) { length += sizeof(struct iphdr); - if(opt) length += opt->optlen; + if(opt) + { + /* make sure to not exceed the max packet size */ + if (0xffff-length < opt->optlen) + return -EMSGSIZE; + length += opt->optlen; + } } if(length <= dev->mtu && !MULTICAST(daddr) && daddr!=0xFFFFFFFF && daddr!=dev->pa_brdaddr) Worked fine here so far.
Andrea
PS. The same bug could be exploited also using udp as normal user. So beware in doing a `chmod u-s /bin/ping`: it's not enough to fix the problem.
- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.rutgers.edu Please read the FAQ at http://www.tux.org/lkml/
| |