Bug 1908251 (CVE-2020-35519) - CVE-2020-35519 kernel: x25_bind out-of-bounds read
Summary: CVE-2020-35519 kernel: x25_bind out-of-bounds read
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2020-35519
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1940204
Blocks: 1895980 1939995
TreeView+ depends on / blocked
 
Reported: 2020-12-16 08:33 UTC by Dhananjay Arunesh
Modified: 2021-05-03 13:41 UTC (History)
49 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory, leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to confidentiality, integrity, as well as system availability.
Clone Of:
Environment:
Last Closed: 2021-04-13 12:38:45 UTC


Attachments (Terms of Use)

Description Dhananjay Arunesh 2020-12-16 08:33:08 UTC
An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system's integrity and availability.

As .x25_addr[] array comes from the user and is not necessarily NUL terminated.  Using strnlen() instead of strlen() will prevent a read overflow problem.

Comment 4 Rohit Keshri 2020-12-17 09:46:10 UTC
Mitigation:

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Comment 8 RaTasha Tillery-Smith 2021-02-16 19:57:17 UTC
Statement:

There was no shipped kernel version affected by this problem. These files are not built in our source code.

Comment 9 Rohit Keshri 2021-03-17 19:32:57 UTC
The .x25_addr[] address comes from the user and is not necessarily
NUL terminated.  This leads to a couple problems.  The first problem is
that the strlen() in x25_bind() can read beyond the end of the buffer.

The second problem is more subtle and could result in memory corruption.
The call tree is:
  x25_connect()
  --> x25_write_internal()
      --> x25_addr_aton()

The .x25_addr[] buffers are copied to the "addresses" buffer from
x25_write_internal() so it will lead to stack corruption.

The x25 protocol only allows 15 character addresses so putting a NUL
terminator as the 16th character is safe and obviously preferable to
reading out of bounds.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
Kiyin, please can you give your Signed-off-by approval as the author of
this patch?

 net/x25/af_x25.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c
index 0bbb283f23c9..3180f15942fe 100644
--- a/net/x25/af_x25.c
+++ b/net/x25/af_x25.c
@@ -686,6 +686,8 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
 		goto out;
 	}
 
+	addr->sx25_addr.x25_addr[X25_ADDR_LEN - 1] = '\0';
+
 	/* check for the null_x25_address */
 	if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) {
 
@@ -779,6 +781,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr,
 		goto out;
 
 	rc = -ENETUNREACH;
+	addr->sx25_addr.x25_addr[X25_ADDR_LEN - 1] = '\0';
 	rt = x25_get_route(&addr->sx25_addr);
 	if (!rt)
 		goto out;

Comment 10 Rohit Keshri 2021-03-17 19:42:40 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 1940204]

Comment 11 Justin M. Forbes 2021-03-19 17:22:15 UTC
Fedora does not enable X25.

Comment 12 Product Security DevOps Team 2021-04-13 12:38:45 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2020-35519


Note You need to log in before you can comment on or make changes to this bug.