Patchwork [lucid/fsl-imx51] CVE-2010-3859

login
register
mail settings
Submitter Paolo Pisati
Date June 30, 2011, 9:54 a.m.
Message ID <4E0C47EE.8010504@canonical.com>
Download mbox | patch
Permalink /patch/102731/
State New
Headers show

Comments

Paolo Pisati - June 30, 2011, 9:54 a.m.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Attached is the missing patch to close 3859 on lucid/fsl-imx51: this
patch has been derived from the original one (commit upstream
8acfe468b0384e834a303f08ebc4953d72fb690a) since part of the security
issue was introduced after .31 (exactly the missing partial-issue was
introduced with 01db403cf99f739f86903314a489fb420e0e254f) and since
fsl-imx51 is based off .31 we didn't had the "entire issue" but just a
part of it.

With this patch fsl-imx51 becomes identical to the other branch as far
as CVE-2010-3859 is concerned

.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iQEcBAEBAgAGBQJODEfuAAoJEMupOQaAohtUAPwIAKtbgTc3YVFdLw5BXynBT34h
DCTAaZBcnklGx5PmkkMDc8WKBWgKkZNF9N+t+wTAyeN4+Rm+qPxaalaHYdnAb+1v
B4tMLdYVtJ1CmIgVPdofSeVhzFrRHHPs07Z7/QU4pimvOkc1Rj9VnUWCJrVgycky
oUe6wFJU9wNW22uVlP5knS8NDRAN0mL1gk8V5N5EW4r4TampUvXtymkv78aOY4sI
Rveehnpgp6sXE9POxGcGgu1pyWnzxnWmmfJsCs9UnkTFzSEcGHi/C63mqWpSz5c4
4sqd+sX1s+Vt5nGUkZPuQ2cm+jNEmAK7C9ZANwlc8bekk/UXITJlJVmQxy3mJhY=
=C1rr
-----END PGP SIGNATURE-----
Tim Gardner - June 30, 2011, 11:04 a.m.
On 06/30/2011 10:54 AM, Paolo Pisati wrote:
> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> Attached is the missing patch to close 3859 on lucid/fsl-imx51: this
> patch has been derived from the original one (commit upstream
> 8acfe468b0384e834a303f08ebc4953d72fb690a) since part of the security
> issue was introduced after .31 (exactly the missing partial-issue was
> introduced with 01db403cf99f739f86903314a489fb420e0e254f) and since
> fsl-imx51 is based off .31 we didn't had the "entire issue" but just a
> part of it.
>
> With this patch fsl-imx51 becomes identical to the other branch as far
> as CVE-2010-3859 is concerned
>
> .
> -----BEGIN PGP SIGNATURE-----
> Version: GnuPG v1.4.11 (GNU/Linux)
> Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/
>
> iQEcBAEBAgAGBQJODEfuAAoJEMupOQaAohtUAPwIAKtbgTc3YVFdLw5BXynBT34h
> DCTAaZBcnklGx5PmkkMDc8WKBWgKkZNF9N+t+wTAyeN4+Rm+qPxaalaHYdnAb+1v
> B4tMLdYVtJ1CmIgVPdofSeVhzFrRHHPs07Z7/QU4pimvOkc1Rj9VnUWCJrVgycky
> oUe6wFJU9wNW22uVlP5knS8NDRAN0mL1gk8V5N5EW4r4TampUvXtymkv78aOY4sI
> Rveehnpgp6sXE9POxGcGgu1pyWnzxnWmmfJsCs9UnkTFzSEcGHi/C63mqWpSz5c4
> 4sqd+sX1s+Vt5nGUkZPuQ2cm+jNEmAK7C9ZANwlc8bekk/UXITJlJVmQxy3mJhY=
> =C1rr
> -----END PGP SIGNATURE-----
>

Patch

From 0e25c0af4ecb7f47d0a4b2e5802d3aa22dc201ab Mon Sep 17 00:00:00 2001
From: Paolo Pisati <paolo.pisati@canonical.com>
Date: Wed, 29 Jun 2011 11:53:00 +0100
Subject: [PATCH] [PATCH] net: Limit socket I/O iovec total length to INT_MAX.

BugLink: http://bugs.launchpad.net/bugs/708839

commit 8acfe468b0384e834a303f08ebc4953d72fb690a upstream.

This helps protect us from overflow issues down in the
individual protocol sendmsg/recvmsg handlers.  Once
we hit INT_MAX we truncate out the rest of the iovec
by setting the iov_len members to zero.

This works because:

1) For SOCK_STREAM and SOCK_SEQPACKET sockets, partial
   writes are allowed and the application will just continue
   with another write to send the rest of the data.

2) For datagram oriented sockets, where there must be a
   one-to-one correspondance between write() calls and
   packets on the wire, INT_MAX is going to be far larger
   than the packet size limit the protocol is going to
   check for and signal with -EMSGSIZE.

Based upon a patch by Linus Torvalds.

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
Signed-off-by: Brad Figg <brad.figg@canonical.com>

Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
---
 net/compat.c     |   10 ++++++----
 net/core/iovec.c |   15 +++++++--------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/net/compat.c b/net/compat.c
index 8d73905..2a2659b 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -40,10 +40,12 @@  static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
 		compat_size_t len;
 
 		if (get_user(len, &uiov32->iov_len) ||
-		   get_user(buf, &uiov32->iov_base)) {
-			tot_len = -EFAULT;
-			break;
-		}
+		    get_user(buf, &uiov32->iov_base))
+			return -EFAULT;
+
+		if (len > INT_MAX - tot_len)
+			len = INT_MAX - tot_len;
+
 		tot_len += len;
 		kiov->iov_base = compat_ptr(buf);
 		kiov->iov_len = (__kernel_size_t) len;
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 16ad45d..b6a4780 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -60,14 +60,13 @@  int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
 	err = 0;
 
 	for (ct = 0; ct < m->msg_iovlen; ct++) {
-		err += iov[ct].iov_len;
-		/*
-		 * Goal is not to verify user data, but to prevent returning
-		 * negative value, which is interpreted as errno.
-		 * Overflow is still possible, but it is harmless.
-		 */
-		if (err < 0)
-			return -EMSGSIZE;
+		size_t len = iov[ct].iov_len;
+
+		if (len > INT_MAX - err) {
+			len = INT_MAX - err;
+			iov[ct].iov_len = len;
+		}
+		err += len;
 	}
 
 	return err;
-- 
1.7.4.1