aboutsummaryrefslogtreecommitdiffstats
path: root/net/socket.c
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2013-10-03 00:27:20 +0300
committerBen Hutchings <ben@decadent.org.uk>2013-11-28 14:01:56 +0000
commitf1d515ce7d27262d9acb468aece806264886a9be (patch)
tree866f436aded6b2ccaa69e56617546ef288d47d7e /net/socket.c
parentea54bc74c4cc418b395bc361fb1138255ea18080 (diff)
downloadkernel_samsung_smdk4412-f1d515ce7d27262d9acb468aece806264886a9be.zip
kernel_samsung_smdk4412-f1d515ce7d27262d9acb468aece806264886a9be.tar.gz
kernel_samsung_smdk4412-f1d515ce7d27262d9acb468aece806264886a9be.tar.bz2
net: heap overflow in __audit_sockaddr()
[ Upstream commit 1661bf364ae9c506bc8795fef70d1532931be1e8 ] We need to cap ->msg_namelen or it leads to a buffer overflow when we to the memcpy() in __audit_sockaddr(). It requires CAP_AUDIT_CONTROL to exploit this bug. The call tree is: ___sys_recvmsg() move_addr_to_user() audit_sockaddr() __audit_sockaddr() Reported-by: Jüri Aedla <juri.aedla@gmail.com> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'net/socket.c')
-rw-r--r--net/socket.c24
1 files changed, 20 insertions, 4 deletions
diff --git a/net/socket.c b/net/socket.c
index cf546a3..bf7adaa 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -1876,6 +1876,16 @@ struct used_address {
unsigned int name_len;
};
+static int copy_msghdr_from_user(struct msghdr *kmsg,
+ struct msghdr __user *umsg)
+{
+ if (copy_from_user(kmsg, umsg, sizeof(struct msghdr)))
+ return -EFAULT;
+ if (kmsg->msg_namelen > sizeof(struct sockaddr_storage))
+ return -EINVAL;
+ return 0;
+}
+
static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
struct msghdr *msg_sys, unsigned flags,
struct used_address *used_address)
@@ -1894,8 +1904,11 @@ static int ___sys_sendmsg(struct socket *sock, struct msghdr __user *msg,
if (MSG_CMSG_COMPAT & flags) {
if (get_compat_msghdr(msg_sys, msg_compat))
return -EFAULT;
- } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
- return -EFAULT;
+ } else {
+ err = copy_msghdr_from_user(msg_sys, msg);
+ if (err)
+ return err;
+ }
/* do not move before msg_sys is valid */
err = -EMSGSIZE;
@@ -2110,8 +2123,11 @@ static int ___sys_recvmsg(struct socket *sock, struct msghdr __user *msg,
if (MSG_CMSG_COMPAT & flags) {
if (get_compat_msghdr(msg_sys, msg_compat))
return -EFAULT;
- } else if (copy_from_user(msg_sys, msg, sizeof(struct msghdr)))
- return -EFAULT;
+ } else {
+ err = copy_msghdr_from_user(msg_sys, msg);
+ if (err)
+ return err;
+ }
err = -EMSGSIZE;
if (msg_sys->msg_iovlen > UIO_MAXIOV)