inet_diag: validate port comparison byte code to prevent unsafe reads
Add logic to verify that a port comparison byte code operation actually has the second inet_diag_bc_op from which we read the port for such operations. Previously the code blindly referenced op[1] without first checking whether a second inet_diag_bc_op struct could fit there. So a malicious user could make the kernel read 4 bytes beyond the end of the bytecode array by claiming to have a whole port comparison byte code (2 inet_diag_bc_op structs) when in fact the bytecode was not long enough to hold both. Signed-off-by: Neal Cardwell <ncardwell@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Родитель
f67caec906
Коммит
5e1f54201c
|
@ -557,6 +557,17 @@ static bool valid_hostcond(const struct inet_diag_bc_op *op, int len,
|
|||
return true;
|
||||
}
|
||||
|
||||
/* Validate a port comparison operator. */
|
||||
static inline bool valid_port_comparison(const struct inet_diag_bc_op *op,
|
||||
int len, int *min_len)
|
||||
{
|
||||
/* Port comparisons put the port in a follow-on inet_diag_bc_op. */
|
||||
*min_len += sizeof(struct inet_diag_bc_op);
|
||||
if (len < *min_len)
|
||||
return false;
|
||||
return true;
|
||||
}
|
||||
|
||||
static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
|
||||
{
|
||||
const void *bc = bytecode;
|
||||
|
@ -572,24 +583,30 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len)
|
|||
case INET_DIAG_BC_D_COND:
|
||||
if (!valid_hostcond(bc, len, &min_len))
|
||||
return -EINVAL;
|
||||
/* fall through */
|
||||
case INET_DIAG_BC_AUTO:
|
||||
break;
|
||||
case INET_DIAG_BC_S_GE:
|
||||
case INET_DIAG_BC_S_LE:
|
||||
case INET_DIAG_BC_D_GE:
|
||||
case INET_DIAG_BC_D_LE:
|
||||
case INET_DIAG_BC_JMP:
|
||||
if (op->no < min_len || op->no > len + 4 || op->no & 3)
|
||||
return -EINVAL;
|
||||
if (op->no < len &&
|
||||
!valid_cc(bytecode, bytecode_len, len - op->no))
|
||||
if (!valid_port_comparison(bc, len, &min_len))
|
||||
return -EINVAL;
|
||||
break;
|
||||
case INET_DIAG_BC_AUTO:
|
||||
case INET_DIAG_BC_JMP:
|
||||
case INET_DIAG_BC_NOP:
|
||||
break;
|
||||
default:
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (op->code != INET_DIAG_BC_NOP) {
|
||||
if (op->no < min_len || op->no > len + 4 || op->no & 3)
|
||||
return -EINVAL;
|
||||
if (op->no < len &&
|
||||
!valid_cc(bytecode, bytecode_len, len - op->no))
|
||||
return -EINVAL;
|
||||
}
|
||||
|
||||
if (op->yes < min_len || op->yes > len + 4 || op->yes & 3)
|
||||
return -EINVAL;
|
||||
bc += op->yes;
|
||||
|
|
Загрузка…
Ссылка в новой задаче