Attachment 315008 Details for Bug 460093 – Upstream patch for this issue

[patch] Upstream patch for this issue

0001-sctp-add-verification-checks-to-SCTP_AUTH_KEY-optio.patch (text/plain), 1.53 KB, created by Eugene Teo (Security Response) on 2008-08-26 15:15:47 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Eugene Teo (Security Response)

Created: 2008-08-26 15:15:47 UTC

Size: 1.53 KB

patch

obsolete

>From 30c2235cbc477d4629983d440cdc4f496fec9246 Mon Sep 17 00:00:00 2001
>From: Vlad Yasevich <vladislav.yasevich@hp.com>
>Date: Mon, 25 Aug 2008 15:16:19 -0700
>Subject: [PATCH] sctp: add verification checks to SCTP_AUTH_KEY option
>
>The structure used for SCTP_AUTH_KEY option contains a
>length that needs to be verfied to prevent buffer overflow
>conditions.  Spoted by Eugene Teo <eteo@redhat.com>.
>
>Signed-off-by: Vlad Yasevich <vladislav.yasevich@hp.com>
>Signed-off-by: David S. Miller <davem@davemloft.net>
>---
> net/sctp/auth.c   |    4 ++++
> net/sctp/socket.c |    5 +++++
> 2 files changed, 9 insertions(+), 0 deletions(-)
>
>diff --git a/net/sctp/auth.c b/net/sctp/auth.c
>index 675a5c3..1fcb4cf 100644
>--- a/net/sctp/auth.c
>+++ b/net/sctp/auth.c
>@@ -80,6 +80,10 @@ static struct sctp_auth_bytes *sctp_auth_create_key(__u32 key_len, gfp_t gfp)
> {
> 	struct sctp_auth_bytes *key;
> 
>+	/* Verify that we are not going to overflow INT_MAX */
>+	if ((INT_MAX - key_len) < sizeof(struct sctp_auth_bytes))
>+		return NULL;
>+
> 	/* Allocate the shared key */
> 	key = kmalloc(sizeof(struct sctp_auth_bytes) + key_len, gfp);
> 	if (!key)
>diff --git a/net/sctp/socket.c b/net/sctp/socket.c
>index bb5c9ef..afa952e 100644
>--- a/net/sctp/socket.c
>+++ b/net/sctp/socket.c
>@@ -3144,6 +3144,11 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
> 		goto out;
> 	}
> 
>+	if (authkey->sca_keylength > optlen) {
>+		ret = -EINVAL;
>+		goto out;
>+	}
>+
> 	asoc = sctp_id2assoc(sk, authkey->sca_assoc_id);
> 	if (!asoc && authkey->sca_assoc_id && sctp_style(sk, UDP)) {
> 		ret = -EINVAL;
>-- 
>1.5.5.1
>

Actions: View | Diff

Attachments on bug 460093: 315008 | 315341