From patchwork Tue Oct 11 16:01:20 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Paolo Pisati X-Patchwork-Id: 119013 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 49579B6F62 for ; Wed, 12 Oct 2011 03:01:37 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1RDelk-0001m8-Bd; Tue, 11 Oct 2011 16:01:28 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1RDelg-0001i9-DR for kernel-team@lists.ubuntu.com; Tue, 11 Oct 2011 16:01:24 +0000 Received: from dynamic-adsl-94-36-103-26.clienti.tiscali.it ([94.36.103.26] helo=canonical.com) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1RDelg-0000xi-7o for kernel-team@lists.ubuntu.com; Tue, 11 Oct 2011 16:01:24 +0000 From: Paolo Pisati To: kernel-team@lists.ubuntu.com Subject: [PATCH] [lucid/master] nl80211: fix overflow in ssid_len - CVE-2011-2517 Date: Tue, 11 Oct 2011 18:01:20 +0200 Message-Id: <1318348882-2218-2-git-send-email-paolo.pisati@canonical.com> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1318348882-2218-1-git-send-email-paolo.pisati@canonical.com> References: <1318348882-2218-1-git-send-email-paolo.pisati@canonical.com> X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com When one of the SSID's length passed in a scan or sched_scan request is larger than 255, there will be an overflow in the u8 that is used to store the length before checking. This causes the check to fail and we overrun the buffer when copying the SSID. Fix this by checking the nl80211 attribute length before copying it to the struct. This is a follow up for the previous commit 208c72f4fe44fe09577e7975ba0e7fa0278f3d03, which didn't fix the problem entirely. Reported-by: Ido Yariv Signed-off-by: Luciano Coelho Signed-off-by: John W. Linville CVE-2011-2517 BugLink: http://bugs.launchpad.net/bugs/869245 upstream commit 57a27e1d6a3bb9ad4efeebd3a8c71156d6207536 Signed-off-by: Paolo Pisati --- net/wireless/nl80211.c | 4 ++-- 1 files changed, 2 insertions(+), 2 deletions(-) diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index f0341e4..f72387f 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -2995,11 +2995,11 @@ static int nl80211_trigger_scan(struct sk_buff *skb, struct genl_info *info) i = 0; if (info->attrs[NL80211_ATTR_SCAN_SSIDS]) { nla_for_each_nested(attr, info->attrs[NL80211_ATTR_SCAN_SSIDS], tmp) { - request->ssids[i].ssid_len = nla_len(attr); - if (request->ssids[i].ssid_len > IEEE80211_MAX_SSID_LEN) { + if (nla_len(attr) > IEEE80211_MAX_SSID_LEN) { err = -EINVAL; goto out_free; } + request->ssids[i].ssid_len = nla_len(attr); memcpy(request->ssids[i].ssid, nla_data(attr), nla_len(attr)); i++; }