lkml.org 
[lkml]   [2017]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 03/16] xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Andy Whitcroft <apw@canonical.com>

    commit f843ee6dd019bcece3e74e76ad9df0155655d0df upstream.

    Kees Cook has pointed out that xfrm_replay_state_esn_len() is subject to
    wrapping issues. To ensure we are correctly ensuring that the two ESN
    structures are the same size compare both the overall size as reported
    by xfrm_replay_state_esn_len() and the internal length are the same.

    CVE-2017-7184
    Signed-off-by: Andy Whitcroft <apw@canonical.com>
    Acked-by: Steffen Klassert <steffen.klassert@secunet.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/xfrm/xfrm_user.c | 6 +++++-
    1 file changed, 5 insertions(+), 1 deletion(-)

    --- a/net/xfrm/xfrm_user.c
    +++ b/net/xfrm/xfrm_user.c
    @@ -412,7 +412,11 @@ static inline int xfrm_replay_verify_len
    up = nla_data(rp);
    ulen = xfrm_replay_state_esn_len(up);

    - if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen)
    + /* Check the overall length and the internal bitmap length to avoid
    + * potential overflow. */
    + if (nla_len(rp) < ulen ||
    + xfrm_replay_state_esn_len(replay_esn) != ulen ||
    + replay_esn->bmp_len != up->bmp_len)
    return -EINVAL;

    if (up->replay_window > up->bmp_len * sizeof(__u32) * 8)

    \
     
     \ /
      Last update: 2017-03-30 12:20    [W:5.142 / U:0.812 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site