| Message ID | 20230523082903.117626-1-Ilia.Gavrilov@infotecs.ru (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 878ecb0897f4737a4c9401f3523fd49589025671 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net] ipv6: Fix out-of-bounds access in ipv6_find_tlv() | expand |
Tue, May 23, 2023 at 10:29:44AM CEST, Ilia.Gavrilov@infotecs.ru wrote: >optlen is fetched without checking whether there is more than one byte to parse. >It can lead to out-of-bounds access. > >Found by InfoTeCS on behalf of Linux Verification Center >(linuxtesting.org) with SVACE. > >Fixes: 3c73a0368e99 ("ipv6: Update ipv6 static library with newly needed functions") >Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> Reviewed-by: Jiri Pirko <jiri@nvidia.com>
On 5/23/23 2:29 AM, Gavrilov Ilia wrote: > optlen is fetched without checking whether there is more than one byte to parse. > It can lead to out-of-bounds access. > > Found by InfoTeCS on behalf of Linux Verification Center > (linuxtesting.org) with SVACE. > > Fixes: 3c73a0368e99 ("ipv6: Update ipv6 static library with newly needed functions") That is not the right Fixes tag; that commit only moved the code. Fixes: c61a40432509 ("[IPV6]: Find option offset by type.") > Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> > --- > net/ipv6/exthdrs_core.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c > index da46c4284676..49e31e4ae7b7 100644 > --- a/net/ipv6/exthdrs_core.c > +++ b/net/ipv6/exthdrs_core.c > @@ -143,6 +143,8 @@ int ipv6_find_tlv(const struct sk_buff *skb, int offset, int type) > optlen = 1; > break; > default: > + if (len < 2) > + goto bad; > optlen = nh[offset + 1] + 2; > if (optlen > len) > goto bad; Reviewed-by: David Ahern <dsahern@kernel.org>
Hello: This patch was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Tue, 23 May 2023 08:29:44 +0000 you wrote: > optlen is fetched without checking whether there is more than one byte to parse. > It can lead to out-of-bounds access. > > Found by InfoTeCS on behalf of Linux Verification Center > (linuxtesting.org) with SVACE. > > Fixes: 3c73a0368e99 ("ipv6: Update ipv6 static library with newly needed functions") > Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> > > [...] Here is the summary with links: - [net] ipv6: Fix out-of-bounds access in ipv6_find_tlv() https://git.kernel.org/netdev/net/c/878ecb0897f4 You are awesome, thank you!
diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c index da46c4284676..49e31e4ae7b7 100644 --- a/net/ipv6/exthdrs_core.c +++ b/net/ipv6/exthdrs_core.c @@ -143,6 +143,8 @@ int ipv6_find_tlv(const struct sk_buff *skb, int offset, int type) optlen = 1; break; default: + if (len < 2) + goto bad; optlen = nh[offset + 1] + 2; if (optlen > len) goto bad;
optlen is fetched without checking whether there is more than one byte to parse. It can lead to out-of-bounds access. Found by InfoTeCS on behalf of Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 3c73a0368e99 ("ipv6: Update ipv6 static library with newly needed functions") Signed-off-by: Gavrilov Ilia <Ilia.Gavrilov@infotecs.ru> --- net/ipv6/exthdrs_core.c | 2 ++ 1 file changed, 2 insertions(+)