Bug 1908251 (CVE-2020-35519)

Summary: CVE-2020-35519 kernel: x25_bind out-of-bounds read
Product: [Other] Security Response Reporter: Dhananjay Arunesh <darunesh>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: acaringi, adscvr, airlied, alciregi, bhu, blc, bmasney, brdeoliv, bskeggs, chwhite, dhoward, dvlasenk, esammons, fhrbata, fpacheco, hdegoede, hkrzesin, iboverma, jarodwilson, jeremy, jforbes, jglisse, jlelli, jonathan, josef, jross, jshortt, jstancek, jwboyer, kcarcia, kernel-maint, kernel-mgr, lgoncalv, linville, masami256, mchehab, mcressma, mlangsdo, nmurray, ptalbert, qzhao, rkeshri, rt-maint, rvrbovsk, security-response-team, steved, swood, walters, williams
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-04-13 12:38:45 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1940204    
Bug Blocks: 1895980, 1939995    

Description Dhananjay Arunesh 2020-12-16 08:33:08 UTC
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system's integrity and availability.

As .x25_addr[] array comes from the user and is not necessarily NUL terminated.  Using strnlen() instead of strlen() will prevent a read overflow problem.

Comment 4 Rohit Keshri 2020-12-17 09:46:10 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 8 RaTasha Tillery-Smith 2021-02-16 19:57:17 UTC
Statement:

There was no shipped kernel version affected by this problem. These files are not built in our source code.

Comment 9 Rohit Keshri 2021-03-17 19:32:57 UTC
The .x25_addr[] address comes from the user and is not necessarily
NUL terminated.  This leads to a couple problems.  The first problem is
that the strlen() in x25_bind() can read beyond the end of the buffer.

The second problem is more subtle and could result in memory corruption.
The call tree is:
  x25_connect()
  --> x25_write_internal()
      --> x25_addr_aton()

The .x25_addr[] buffers are copied to the "addresses" buffer from
x25_write_internal() so it will lead to stack corruption.

The x25 protocol only allows 15 character addresses so putting a NUL
terminator as the 16th character is safe and obviously preferable to
reading out of bounds.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Kiyin, please can you give your Signed-off-by approval as the author of
this patch?

 net/x25/af_x25.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 0bbb283f23c9..3180f15942fe 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -686,6 +686,8 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 		goto out;
 	}
 
+	addr->sx25_addr.x25_addr[X25_ADDR_LEN - 1] = '\0';
+
 	/* check for the null_x25_address */
 	if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
 
@@ -779,6 +781,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
 		goto out;
 
 	rc = -ENETUNREACH;
+	addr->sx25_addr.x25_addr[X25_ADDR_LEN - 1] = '\0';
 	rt = x25_get_route(&addr->sx25_addr);
 	if (!rt)
 		goto out;

Comment 10 Rohit Keshri 2021-03-17 19:42:40 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1940204]

Comment 11 Justin M. Forbes 2021-03-19 17:22:15 UTC
Fedora does not enable X25.

Comment 12 Product Security DevOps Team 2021-04-13 12:38:45 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-35519