Skip to main content

Browse the archive

https://github.com/torvalds/linux
23 October 2021, 00:29:24 UTC
Revision 6ee50c8e262a0f0693dad264c3c99e30e6442a56 authored by Dan Carpenter on 01 December 2020, 15:15:12 UTC, committed by Jakub Kicinski on 03 December 2020, 01:26:36 UTC 
net/x25: prevent a couple of overflows
 
The .x25_addr[] address comes from the user and is not necessarily
NUL terminated.  This leads to a couple problems.  The first problem is
that the strlen() in x25_bind() can read beyond the end of the buffer.

The second problem is more subtle and could result in memory corruption.
The call tree is:
  x25_connect()
  --> x25_write_internal()
      --> x25_addr_aton()

The .x25_addr[] buffers are copied to the "addresses" buffer from
x25_write_internal() so it will lead to stack corruption.

Verify that the strings are NUL terminated and return -EINVAL if they
are not.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Fixes: a9288525d2ae ("X25: Dont let x25_bind use addresses containing characters")
Reported-by: "kiyin(尹亮)" <kiyin@tencent.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Acked-by: Martin Schiller <ms@dev.tdt.de>
Link: https://lore.kernel.org/r/X8ZeAKm8FnFpN//B@mwanda
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
1 parent 07500a6
History
Tip revision: 6ee50c8e262a0f0693dad264c3c99e30e6442a56 authored by Dan Carpenter on 01 December 2020, 15:15:12 UTC
net/x25: prevent a couple of overflows
Tip revision: 6ee50c8
File Mode Size
apparmor
bpf
integrity
keys
loadpin
lockdown
safesetid
selinux
smack
tomoyo
yama
Kconfig -rw-r--r-- 10.7 KB
Kconfig.hardening -rw-r--r-- 8.8 KB
Makefile -rw-r--r-- 1.3 KB
commoncap.c -rw-r--r-- 39.0 KB
device_cgroup.c -rw-r--r-- 21.1 KB
inode.c -rw-r--r-- 10.6 KB
lsm_audit.c -rw-r--r-- 10.8 KB
min_addr.c -rw-r--r-- 1.3 KB
security.c -rw-r--r-- 63.8 KB
back to top