On Sat, 20 Oct 2001 22:28:50 -0700 (PDT)
Ken Ashcraft <kash@stanford.edu> wrote:
> Hi All,
Hi Ken,
I'm prepared to live with the iptables ones:
> ---------------------------------------------------------
> [BUG] MINOR checked indirectly.
> /home/kash/linux/2.4.12/net/ipv6/netfilter/ip6_tables.c:1111:do_replace: ERROR:RANGE:1106:1111: Using user length "size" as argument to "copy_from_user" [type=LOCAL] [state = need_ub] set by 'copy_from_user':1106 [distance=13]
>
> if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
> return -EFAULT;
>
> newinfo = vmalloc(sizeof(struct ip6t_table_info)
> Start --->
> + SMP_ALIGN(tmp.size) * smp_num_cpus);
> if (!newinfo)
> return -ENOMEM;
>
> if (copy_from_user(newinfo->entries, user + sizeof(tmp),
> Error --->
> tmp.size) != 0) {
> ret = -EFAULT;
> goto free_newinfo;
> }
Yes, if a malicious user has CAP_NET_ADMIN they can hit the BUG() in vmalloc().
Of course, we have other problems then, too...
Still, here is the fix, if only to stop you guys complaining 8)
diff -urN -I \$.*\$ --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.12-official/net/ipv4/netfilter/ip_tables.c working-2.4.12-nfsize/net/ipv4/netfilter/ip_tables.c
--- linux-2.4.12-official/net/ipv4/netfilter/ip_tables.c Wed Oct 10 17:37:58 2001
+++ working-2.4.12-nfsize/net/ipv4/netfilter/ip_tables.c Thu Oct 25 11:56:01 2001
@@ -1059,6 +1059,10 @@
if (len != sizeof(tmp) + tmp.size)
return -ENOPROTOOPT;
+ /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
+ if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)
+ return -ENOMEM;
+
newinfo = vmalloc(sizeof(struct ipt_table_info)
+ SMP_ALIGN(tmp.size) * smp_num_cpus);
if (!newinfo)
diff -urN -I \$.*\$ --exclude TAGS -X /home/rusty/devel/kernel/kernel-patches/current-dontdiff --minimal linux-2.4.12-official/net/ipv6/netfilter/ip6_tables.c working-2.4.12-nfsize/net/ipv6/netfilter/ip6_tables.c
--- linux-2.4.12-official/net/ipv6/netfilter/ip6_tables.c Wed Oct 10 17:37:58 2001
+++ working-2.4.12-nfsize/net/ipv6/netfilter/ip6_tables.c Thu Oct 25 11:56:27 2001
@@ -1102,6 +1102,10 @@
if (copy_from_user(&tmp, user, sizeof(tmp)) != 0)
return -EFAULT;
+ /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
+ if ((SMP_ALIGN(tmp.size) >> PAGE_SHIFT) + 2 > num_physpages)
+ return -ENOMEM;
+
newinfo = vmalloc(sizeof(struct ip6t_table_info)
+ SMP_ALIGN(tmp.size) * smp_num_cpus);
if (!newinfo)
Rusty.
-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
This archive was generated by hypermail 2b29 : Wed Oct 31 2001 - 21:00:24 EST