Message ID | 20241008090259.20785-1-p.vaganov@ideco.ru (mailing list archive) |
---|---|
State | Awaiting Upstream |
Delegated to: | Netdev Maintainers |
Headers | show |
Series | [ipsec,v3] xfrm: fix one more kernel-infoleak in algo dumping | expand |
… > --- > v3: Corrected commit description "This patch fixes copying..." to > "Fixes copying..." according to accepted rules of Linux kernel commits, > as suggested by … How do you think about to choose another imperative wording for an improved change description? https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v6.12-rc2#n94 Regards, Markus
On Tue, Oct 08, 2024 at 02:02:58PM +0500, Petr Vaganov wrote: > During fuzz testing, the following issue was discovered: > > BUG: KMSAN: kernel-infoleak in _copy_to_iter+0x598/0x2a30 ... > > Bytes 328-379 of 732 are uninitialized > Memory access of size 732 starts at ffff88800e18e000 > Data copied to user address 00007ff30f48aff0 > > CPU: 2 PID: 18167 Comm: syz-executor.0 Not tainted 6.8.11 #1 > Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014 > > Fixes copying of xfrm algorithms where some random > data of the structure fields can end up in userspace. > Padding in structures may be filled with random (possibly sensitve) > data and should never be given directly to user-space. > > A similar issue was resolved in the commit > 8222d5910dae ("xfrm: Zero padding when dumping algos and encap") > > Found by Linux Verification Center (linuxtesting.org) with Syzkaller. > > Fixes: c7a5899eb26e ("xfrm: redact SA secret with lockdown confidentiality") > Cc: stable@vger.kernel.org > Co-developed-by: Boris Tonofa <b.tonofa@ideco.ru> > Signed-off-by: Boris Tonofa <b.tonofa@ideco.ru> > Signed-off-by: Petr Vaganov <p.vaganov@ideco.ru> Applied, thanks a lot!
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index 55f039ec3d59..0083faabe8be 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -1098,7 +1098,9 @@ static int copy_to_user_auth(struct xfrm_algo_auth *auth, struct sk_buff *skb) if (!nla) return -EMSGSIZE; ap = nla_data(nla); - memcpy(ap, auth, sizeof(struct xfrm_algo_auth)); + strscpy_pad(ap->alg_name, auth->alg_name, sizeof(ap->alg_name)); + ap->alg_key_len = auth->alg_key_len; + ap->alg_trunc_len = auth->alg_trunc_len; if (redact_secret && auth->alg_key_len) memset(ap->alg_key, 0, (auth->alg_key_len + 7) / 8); else