Received: by 2002:ac0:98c7:0:0:0:0:0 with SMTP id g7-v6csp1644468imd; Sat, 27 Oct 2018 13:55:12 -0700 (PDT) X-Google-Smtp-Source: AJdET5f8UELwm7vDHPAwZ9XSl9uwuIiHUvhd3Wa9U2Y9zFbHnUZcFBt/uPhvBDUdn93NkMXM0ZZQ X-Received: by 2002:a63:9a52:: with SMTP id e18mr5565987pgo.14.1540673712480; Sat, 27 Oct 2018 13:55:12 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1540673712; cv=none; d=google.com; s=arc-20160816; b=czR74seANb474Vsde4362DIOWcebm90+2Jp8efypmQY0Sppf1DtkrBc6TeG7KtZeqI lU6GZNFUPNS8I5KveJ+xkvisZKmJinb30SFk2jBbZexipwNtVnIN1+6odCus/gKaJVRd qehdi2BS8DU0bxzd6GIiEhhocFsAN7eSOjrKQWZiERhxbDAKG8n1kWDptskuXJwbYSAc mE8QhgL5Ap/7E/7vdm/6AtaHOokDzFgzLYv9Tly60fLLymvbyFv6SJkfF+wN3vxSpcla aujy2wuq5VF0g76MhhIraThPI2GkAgEcCdxrrzOoOTntqc+l9YUvmincbxlqDMswocAE KosQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:message-id:date:subject:cc:to:from :dkim-signature; bh=NouTOrVxM+TYM0FPOjxglnjMsZBSdocm3PI+f9WRak0=; b=Wqsrx6OYBrYFjXCaRi1JYp9/dfND/MqBTWWKRu77IUsPD2WEnu/D5Zx4d6hV9/FWbJ rnrRweVPpK8MP0KZaUtGUtAT3Y4j8ouVI3Ujg9Safv6u4DaOuOKx9xrWIJYhXILtxfC9 XvlMjz+uaoMmTZCqL0DNanXxGuQSrPe1i0ha7YERexW0SldNP8TOwLg7ELbk+x0eU0OP Cihl3tAzODte7cynQY0YCMtMWJM1YzoHuFFaYk9UA0oTS0zYu4nP4L7QC4n1mzDKWKwP Jbt+W4AWjRP7kI1EW81KWmcNBLxemAX+/E8hIBWidDepZeuBd91Z0JRc7ak+nXHuiPmH jxLA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=UyTdicCi; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id c12-v6si15981368pgj.70.2018.10.27.13.54.56; Sat, 27 Oct 2018 13:55:12 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@gmail.com header.s=20161025 header.b=UyTdicCi; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728924AbeJ1Ffl (ORCPT + 99 others); Sun, 28 Oct 2018 01:35:41 -0400 Received: from mail-lj1-f194.google.com ([209.85.208.194]:46087 "EHLO mail-lj1-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727312AbeJ1Ffl (ORCPT ); Sun, 28 Oct 2018 01:35:41 -0400 Received: by mail-lj1-f194.google.com with SMTP id x3-v6so4236409lji.13; Sat, 27 Oct 2018 13:53:26 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=NouTOrVxM+TYM0FPOjxglnjMsZBSdocm3PI+f9WRak0=; b=UyTdicCiSNt98rqfVKE3tjd5BYfHPs6nOBiFi6pK5a9HqqtFab9dlTs9Q2l9M+x+X8 K82XPS92DrvuPNTyU3c4n/M0jzkxTCJlsOVWCcElGjI4QrDSVX9jjVRCQ9VNm/W/Mspb NiY44FjxC3IPIykolQVref5A9QkEYFbvm7hXP/bMpQyjPSkMKmoeabn+KH2e6dkSFO7j 4FNY2Hg5y+dZu7afRANTqCNBxqjcHE6wFKK2jfBhqgRg0QM3BB5Pei0PHpM4hI1gEKq9 aKQZVvlYqRjYvqVsN07EwsDwmRDFqmadb4yF2C8w5fX6zflfNbl8vBk/sUBv3HwZEzlu K2mA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=NouTOrVxM+TYM0FPOjxglnjMsZBSdocm3PI+f9WRak0=; b=fAFLNJpZ0kTVjYGsWP2sUyn3hfme+C3bLGJSvZUiJXHBR9HMyxjgwWRw8c1wb3wTU6 9UwuJBAODR/Eed/VDrkUgWAMojsNXzmF83Pv+QbWpMWZFDvnTfgevL/Nmx0JEzqGOzvq 2YgCGnQUQz3bg7L7Ic24zTAA3WRkuGz2DgF/f7zu0wSOuZiQhbkylaoYoLcXsVFEaZwW FjO9fjY3cwXdn352sh3cf7PQnuSCktcIItLH0F0EtGNkE6T6d4c+FNgvLqhjRfPtQN/T B6bKs6W0gSHHxhxHrcXG9amgTM09mmtUR5xy7BRSa+ig0ERMzk2z5Vwd5Uz9GNnC4+Ds gh3w== X-Gm-Message-State: AGRZ1gKEd8AK1ZLnx28ox0yKgGsBNjGzRpo70x6wI/RxYPdxoewAhmDF AHM/T5UFtXRPd1SBBiG2glQ= X-Received: by 2002:a2e:9b46:: with SMTP id o6-v6mr6084715ljj.78.1540673605485; Sat, 27 Oct 2018 13:53:25 -0700 (PDT) Received: from localhost.localdomain ([95.174.65.6]) by smtp.gmail.com with ESMTPSA id g3-v6sm2080077lfj.3.2018.10.27.13.53.24 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Sat, 27 Oct 2018 13:53:25 -0700 (PDT) From: Tomas Bortoli To: vyasevich@gmail.com, nhorman@tuxdriver.com, marcelo.leitner@gmail.com Cc: davem@davemloft.net, linux-sctp@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Tomas Bortoli Subject: [PATCH v2] sctp: socket.c validate sprstat_policy Date: Sat, 27 Oct 2018 22:53:20 +0200 Message-Id: <20181027205320.14975-1-tomasbortoli@gmail.com> X-Mailer: git-send-email 2.11.0 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org It is possible to perform out-of-bound reads on sctp_getsockopt_pr_streamstatus() and on sctp_getsockopt_pr_assocstatus() by passing from userspace a sprstat_policy that overflows the abandoned_sent/abandoned_unsent fixed length arrays. The over-read data are directly copied/leaked to userspace. Signed-off-by: Tomas Bortoli Reported-by: syzbot+5da0d0a72a9e7d791748@syzkaller.appspotmail.com --- net/sctp/socket.c | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index fc0386e8ff23..14dce5d95817 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -7083,7 +7083,9 @@ static int sctp_getsockopt_pr_assocstatus(struct sock *sk, int len, } policy = params.sprstat_policy; - if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL))) + if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)) || + __SCTP_PR_INDEX(policy) > SCTP_PR_INDEX(MAX) || + __SCTP_PR_INDEX(policy) < 0) goto out; asoc = sctp_id2assoc(sk, params.sprstat_assoc_id); @@ -7142,7 +7144,9 @@ static int sctp_getsockopt_pr_streamstatus(struct sock *sk, int len, } policy = params.sprstat_policy; - if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL))) + if (!policy || (policy & ~(SCTP_PR_SCTP_MASK | SCTP_PR_SCTP_ALL)) || + __SCTP_PR_INDEX(policy) > SCTP_PR_INDEX(MAX) || + __SCTP_PR_INDEX(policy) < 0) goto out; asoc = sctp_id2assoc(sk, params.sprstat_assoc_id); -- 2.11.0