diff options
| author | Linus Torvalds <torvalds@linux-foundation.org> | 2017-03-29 13:26:22 -0700 |
|---|---|---|
| committer | Linus Torvalds <torvalds@linux-foundation.org> | 2017-03-29 13:26:22 -0700 |
| commit | 52b9c816807abd46c285cd8ab183fe93194bfb3f (patch) | |
| tree | 3888fddd6dbaeb7a960d9c776181ee276ea40e72 /net | |
| parent | 72c33734b5fa8a788734ad2312a89b944589c5a0 (diff) | |
| parent | f843ee6dd019bcece3e74e76ad9df0155655d0df (diff) | |
| download | linux-0-day-52b9c816807abd46c285cd8ab183fe93194bfb3f.tar.gz linux-0-day-52b9c816807abd46c285cd8ab183fe93194bfb3f.tar.xz | |
Merge branch 'apw' (xfrm_user fixes)
Merge xfrm_user validation fixes from Andy Whitcroft:
"Two patches we are applying to Ubuntu for XFRM_MSG_NEWAE validation
issue reported by ZDI.
The first of these is the primary fix, and the second is for a more
theoretical issue that Kees pointed out when reviewing the first"
* emailed patches from Andy Whitcroft <apw@canonical.com>:
xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder
xfrm_user: validate XFRM_MSG_NEWAE XFRMA_REPLAY_ESN_VAL replay_window
Diffstat (limited to 'net')
| -rw-r--r-- | net/xfrm/xfrm_user.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 9705c279494b2..40a8aa39220d6 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -412,7 +412,14 @@ static inline int xfrm_replay_verify_len(struct xfrm_replay_state_esn *replay_es up = nla_data(rp); ulen = xfrm_replay_state_esn_len(up); - if (nla_len(rp) < ulen || xfrm_replay_state_esn_len(replay_esn) != ulen) + /* Check the overall length and the internal bitmap length to avoid + * potential overflow. */ + if (nla_len(rp) < ulen || + xfrm_replay_state_esn_len(replay_esn) != ulen || + replay_esn->bmp_len != up->bmp_len) + return -EINVAL; + + if (up->replay_window > up->bmp_len * sizeof(__u32) * 8) return -EINVAL; return 0; |