From: Stefan Nuernberger <snu@amazon•com>
To: netdev@vger•kernel.org
Cc: aams@amazon•de, yujuan.qi@mediatek•com, paul@paul-moore•com,
Stefan Nuernberger <snu@amazon•com>,
stable@vger•kernel.org
Subject: [PATCH net] net/ipv4: defensive cipso option parsing
Date: Mon, 17 Sep 2018 17:11:49 +0200 [thread overview]
Message-ID: <20180917151149.22231-1-snu@amazon.com> (raw)
commit 40413955ee26 ("Cipso: cipso_v4_optptr enter infinite loop") fixed
a possible infinite loop in the IP option parsing of CIPSO. The fix
assumes that ip_options_compile filtered out all zero length options and
that no other one-byte options beside IPOPT_END and IPOPT_NOOP exist.
While this assumption currently holds true, add explicit checks for zero
length and invalid length options to be safe for the future. Even though
ip_options_compile should have validated the options, the introduction of
new one-byte options can still confuse this code without the additional
checks.
Signed-off-by: Stefan Nuernberger <snu@amazon•com>
Reviewed-by: David Woodhouse <dwmw@amazon•co.uk>
Reviewed-by: Simon Veith <sveith@amazon•de>
Cc: stable@vger•kernel.org
---
net/ipv4/cipso_ipv4.c | 10 ++++++++--
1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c
index 82178cc69c96..f291b57b8474 100644
--- a/net/ipv4/cipso_ipv4.c
+++ b/net/ipv4/cipso_ipv4.c
@@ -1512,7 +1512,7 @@ static int cipso_v4_parsetag_loc(const struct cipso_v4_doi *doi_def,
*
* Description:
* Parse the packet's IP header looking for a CIPSO option. Returns a pointer
- * to the start of the CIPSO option on success, NULL if one if not found.
+ * to the start of the CIPSO option on success, NULL if one is not found.
*
*/
unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
@@ -1522,9 +1522,11 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
int optlen;
int taglen;
- for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 0; ) {
+ for (optlen = iph->ihl*4 - sizeof(struct iphdr); optlen > 1; ) {
switch (optptr[0]) {
case IPOPT_CIPSO:
+ if (!optptr[1] || optptr[1] > optlen)
+ return NULL;
return optptr;
case IPOPT_END:
return NULL;
@@ -1534,6 +1536,10 @@ unsigned char *cipso_v4_optptr(const struct sk_buff *skb)
default:
taglen = optptr[1];
}
+
+ if (!taglen || taglen > optlen)
+ break;
+
optlen -= taglen;
optptr += taglen;
}
--
2.19.0
next reply other threads:[~2018-09-17 15:11 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-17 15:11 Stefan Nuernberger [this message]
2018-09-17 16:35 ` [PATCH net] net/ipv4: defensive cipso option parsing Paul Moore
2018-09-17 17:46 ` [PATCH v2 " Stefan Nuernberger
2018-09-17 20:31 ` Paul Moore
2018-09-18 2:38 ` David Miller
2018-09-17 18:02 ` [PATCH " Nuernberger, Stefan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180917151149.22231-1-snu@amazon.com \
--to=snu@amazon$(echo .)com \
--cc=aams@amazon$(echo .)de \
--cc=netdev@vger$(echo .)kernel.org \
--cc=paul@paul-moore$(echo .)com \
--cc=stable@vger$(echo .)kernel.org \
--cc=yujuan.qi@mediatek$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox