diff mbox series

[nf,v2] netfilter: xt_CT: Reject the non-null terminated string from user space

Message ID 1527647371-120888-1-git-send-email-gfree.wind@vip.163.com
State Accepted
Delegated to: Pablo Neira
Headers show
Series [nf,v2] netfilter: xt_CT: Reject the non-null terminated string from user space | expand

Commit Message

Gao Feng May 30, 2018, 2:29 a.m. UTC 
From: Gao Feng <gfree.wind@vip.163.com>

The helper and timeout strings are from user-space, we need to make
sure they are null terminated. If not, evil user could make kernel
read the unexpected memory, even print it when fail to find by the
following codes.

pr_info_ratelimited("No such helper \"%s\"\n", helper_name);

Signed-off-by: Gao Feng <gfree.wind@vip.163.com>
---
 v2: reject the non-null terminated string directly, per Pablo
 v1: initial version

 net/netfilter/xt_CT.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

Comments

Florian Westphal May 30, 2018, 8:12 a.m. UTC | #1 
gfree.wind@vip.163.com <gfree.wind@vip.163.com> wrote:
> From: Gao Feng <gfree.wind@vip.163.com>
> 
> The helper and timeout strings are from user-space, we need to make
> sure they are null terminated. If not, evil user could make kernel

Looks good to me, thank you.

Acked-by: Florian Westphal <fw@strlen.de>
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Pablo Neira Ayuso June 1, 2018, 8:13 a.m. UTC | #2 
On Wed, May 30, 2018 at 10:12:34AM +0200, Florian Westphal wrote:
> gfree.wind@vip.163.com <gfree.wind@vip.163.com> wrote:
> > From: Gao Feng <gfree.wind@vip.163.com>
> > 
> > The helper and timeout strings are from user-space, we need to make
> > sure they are null terminated. If not, evil user could make kernel
> 
> Looks good to me, thank you.
> 
> Acked-by: Florian Westphal <fw@strlen.de>

Applied to nf.git, thanks!
--
To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox series

Patch

diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
index 8790190..03b9a50 100644
--- a/net/netfilter/xt_CT.c
+++ b/net/netfilter/xt_CT.c
@@ -245,12 +245,22 @@  static int xt_ct_tg_check(const struct xt_tgchk_param *par,
 	}
 
 	if (info->helper[0]) {
+		if (strnlen(info->helper, sizeof(info->helper)) == sizeof(info->helper)) {
+			ret = -ENAMETOOLONG;
+			goto err3;
+		}
+
 		ret = xt_ct_set_helper(ct, info->helper, par);
 		if (ret < 0)
 			goto err3;
 	}
 
 	if (info->timeout[0]) {
+		if (strnlen(info->timeout, sizeof(info->timeout)) == sizeof(info->timeout)) {
+			ret = -ENAMETOOLONG;
+			goto err4;
+		}
+
 		ret = xt_ct_set_timeout(ct, par, info->timeout);
 		if (ret < 0)
 			goto err4;