lkml.org 
[lkml]   [1999]   [Dec]   [14]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: [security] Big problem on 2.0.x? (fwd)
On Mon, 13 Dec 1999, Andrei Pelinescu-Onciul wrote:

>I didn't look in 2.0.38 yet but in 2.0.36 the problem is in net/ipv4/ip_output.c in ip_build_xmit.
>Here a short int (length) is used to compute the length of the ip packet. At first length contains the length of the packet without the header, then the ip header
>length is added:
>
>if (!sk->ip_hdrincl) {
> length += sizeof(struct iphdr);
> if(opt) length += opt->optlen;
> }
>
>ping -s 65468 -R generates a packet that looks like:
>
>ip header: 20 bytes
>ip options: 40 bytes
>icmp header: 8 bytes
>icmp data: 65468 bytes
>
>If you add all this up you obtain 65536, but length is a short int so length will be 0!

Agreed. Your detection of the problem is correct IMHO.

>A quick way to fix this bug is to add the following if, after the one above:
>
> if (length < 20){
> printk("<1> ip_build_xmit: ERROR: packet too big! "
> "dropping...\n");
> return -EPERM;
> }

I looked at this too and I think your fix is very near to be the right
one. The basics of your changes are right IMO.

I fixed this by checking that the payload is not too big in the case we
have to include in the packet also some ip option. If it's too big
I tell to userspace it's too big. This is my version:

diff -urN 2.0.38/net/ipv4/ip_output.c 2.0.38-ping-R/net/ipv4/ip_output.c
--- 2.0.38/net/ipv4/ip_output.c Thu Jun 18 23:48:22 1998
+++ 2.0.38-ping-R/net/ipv4/ip_output.c Tue Dec 14 23:02:43 1999
@@ -703,7 +703,13 @@

if (!sk->ip_hdrincl) {
length += sizeof(struct iphdr);
- if(opt) length += opt->optlen;
+ if(opt)
+ {
+ /* make sure to not exceed the max packet size */
+ if (0xffff-length < opt->optlen)
+ return -EMSGSIZE;
+ length += opt->optlen;
+ }
}

if(length <= dev->mtu && !MULTICAST(daddr) && daddr!=0xFFFFFFFF && daddr!=dev->pa_brdaddr)
Worked fine here so far.

Andrea

PS. The same bug could be exploited also using udp as normal user. So
beware in doing a `chmod u-s /bin/ping`: it's not enough to fix the
problem.


-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.rutgers.edu
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2005-03-22 13:55    [W:0.086 / U:0.040 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site