An out-of-bounds (OOB) memory access flaw was found in x25_bind in net/x25/af_x25.c in the Linux kernel version v5.12-rc5. A bounds check failure allows a local attacker with a user account on the system to gain access to out-of-bounds memory leading to a system crash or a leak of internal kernel information. The highest threat from this vulnerability is to system's integrity and availability. As .x25_addr[] array comes from the user and is not necessarily NUL terminated. Using strnlen() instead of strlen() will prevent a read overflow problem.
Mitigation: Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Statement: There was no shipped kernel version affected by this problem. These files are not built in our source code.
The .x25_addr[] address comes from the user and is not necessarily NUL terminated. This leads to a couple problems. The first problem is that the strlen() in x25_bind() can read beyond the end of the buffer. The second problem is more subtle and could result in memory corruption. The call tree is: x25_connect() --> x25_write_internal() --> x25_addr_aton() The .x25_addr[] buffers are copied to the "addresses" buffer from x25_write_internal() so it will lead to stack corruption. The x25 protocol only allows 15 character addresses so putting a NUL terminator as the 16th character is safe and obviously preferable to reading out of bounds. Signed-off-by: Dan Carpenter <dan.carpenter> --- Kiyin, please can you give your Signed-off-by approval as the author of this patch? net/x25/af_x25.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/x25/af_x25.c b/net/x25/af_x25.c index 0bbb283f23c9..3180f15942fe 100644 --- a/net/x25/af_x25.c +++ b/net/x25/af_x25.c @@ -686,6 +686,8 @@ static int x25_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) goto out; } + addr->sx25_addr.x25_addr[X25_ADDR_LEN - 1] = '\0'; + /* check for the null_x25_address */ if (strcmp(addr->sx25_addr.x25_addr, null_x25_address.x25_addr)) { @@ -779,6 +781,7 @@ static int x25_connect(struct socket *sock, struct sockaddr *uaddr, goto out; rc = -ENETUNREACH; + addr->sx25_addr.x25_addr[X25_ADDR_LEN - 1] = '\0'; rt = x25_get_route(&addr->sx25_addr); if (!rt) goto out;
Created kernel tracking bugs for this issue: Affects: fedora-all [bug 1940204]
Fedora does not enable X25.
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-35519