lkml.org 
[lkml]   [2020]   [Feb]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 76/89] airo: Fix possible info leak in AIROOLDIOCTL/SIOCDEVPRIVATE
    Date
    From: Michael Ellerman <mpe@ellerman.id.au>

    [ Upstream commit d6bce2137f5d6bb1093e96d2f801479099b28094 ]

    The driver for Cisco Aironet 4500 and 4800 series cards (airo.c),
    implements AIROOLDIOCTL/SIOCDEVPRIVATE in airo_ioctl().

    The ioctl handler copies an aironet_ioctl struct from userspace, which
    includes a command and a length. Some of the commands are handled in
    readrids(), which kmalloc()'s a buffer of RIDSIZE (2048) bytes.

    That buffer is then passed to PC4500_readrid(), which has two cases.
    The else case does some setup and then reads up to RIDSIZE bytes from
    the hardware into the kmalloc()'ed buffer.

    Here len == RIDSIZE, pBuf is the kmalloc()'ed buffer:

    // read the rid length field
    bap_read(ai, pBuf, 2, BAP1);
    // length for remaining part of rid
    len = min(len, (int)le16_to_cpu(*(__le16*)pBuf)) - 2;
    ...
    // read remainder of the rid
    rc = bap_read(ai, ((__le16*)pBuf)+1, len, BAP1);

    PC4500_readrid() then returns to readrids() which does:

    len = comp->len;
    if (copy_to_user(comp->data, iobuf, min(len, (int)RIDSIZE))) {

    Where comp->len is the user controlled length field.

    So if the "rid length field" returned by the hardware is < 2048, and
    the user requests 2048 bytes in comp->len, we will leak the previous
    contents of the kmalloc()'ed buffer to userspace.

    Fix it by kzalloc()'ing the buffer.

    Found by Ilja by code inspection, not tested as I don't have the
    required hardware.

    Reported-by: Ilja Van Sprundel <ivansprundel@ioactive.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/cisco/airo.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/net/wireless/cisco/airo.c b/drivers/net/wireless/cisco/airo.c
    index fc49255bab009..c9ffbdd42e67c 100644
    --- a/drivers/net/wireless/cisco/airo.c
    +++ b/drivers/net/wireless/cisco/airo.c
    @@ -7811,7 +7811,7 @@ static int readrids(struct net_device *dev, aironet_ioctl *comp) {
    return -EINVAL;
    }

    - if ((iobuf = kmalloc(RIDSIZE, GFP_KERNEL)) == NULL)
    + if ((iobuf = kzalloc(RIDSIZE, GFP_KERNEL)) == NULL)
    return -ENOMEM;

    PC4500_readrid(ai,ridcode,iobuf,RIDSIZE, 1);
    --
    2.20.1


    \
     
     \ /
      Last update: 2020-02-03 17:32    [W:4.161 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site