lkml.org 
[lkml]   [2019]   [Mar]   [8]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 30/68] netlabel: fix out-of-bounds memory accesses
    Date
    4.19-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Paul Moore <paul@paul-moore.com>

    [ Upstream commit 5578de4834fe0f2a34fedc7374be691443396d1f ]

    There are two array out-of-bounds memory accesses, one in
    cipso_v4_map_lvl_valid(), the other in netlbl_bitmap_walk(). Both
    errors are embarassingly simple, and the fixes are straightforward.

    As a FYI for anyone backporting this patch to kernels prior to v4.8,
    you'll want to apply the netlbl_bitmap_walk() patch to
    cipso_v4_bitmap_walk() as netlbl_bitmap_walk() doesn't exist before
    Linux v4.8.

    Reported-by: Jann Horn <jannh@google.com>
    Fixes: 446fda4f2682 ("[NetLabel]: CIPSOv4 engine")
    Fixes: 3faa8f982f95 ("netlabel: Move bitmap manipulation functions to the NetLabel core.")
    Signed-off-by: Paul Moore <paul@paul-moore.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/cipso_ipv4.c | 3 ++-
    net/netlabel/netlabel_kapi.c | 3 ++-
    2 files changed, 4 insertions(+), 2 deletions(-)

    --- a/net/ipv4/cipso_ipv4.c
    +++ b/net/ipv4/cipso_ipv4.c
    @@ -667,7 +667,8 @@ static int cipso_v4_map_lvl_valid(const
    case CIPSO_V4_MAP_PASS:
    return 0;
    case CIPSO_V4_MAP_TRANS:
    - if (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL)
    + if ((level < doi_def->map.std->lvl.cipso_size) &&
    + (doi_def->map.std->lvl.cipso[level] < CIPSO_V4_INV_LVL))
    return 0;
    break;
    }
    --- a/net/netlabel/netlabel_kapi.c
    +++ b/net/netlabel/netlabel_kapi.c
    @@ -903,7 +903,8 @@ int netlbl_bitmap_walk(const unsigned ch
    (state == 0 && (byte & bitmask) == 0))
    return bit_spot;

    - bit_spot++;
    + if (++bit_spot >= bitmap_len)
    + return -1;
    bitmask >>= 1;
    if (bitmask == 0) {
    byte = bitmap[++byte_offset];

    \
     
     \ /
      Last update: 2019-03-08 14:04    [W:4.728 / U:0.068 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site