xfrm: Validate address prefix lengths in the xfrm selector. (07bf7908) · Commits · 戴 / test

We don't validate the address prefix lengths in the xfrm selector we got from userspace. This can lead to undefined behaviour in the address matching functions if the prefix is too big for the given address family. Fix this by checking the prefixes and refuse SA/policy insertation when a prefix is invalid. Fixes: ("Linux-2.6.12-rc2") Reported-by:

Air Icy <icytxw@gmail.com> Signed-off-by:

Steffen Klassert <steffen.klassert@secunet.com>

net/xfrm/xfrm_user.c

+12 −0

Original line number	Diff line number	Diff line
		@@ -151,10 +151,16 @@ static int verify_newsa_info(struct xfrm_usersa_info *p,
		err = -EINVAL;
		switch (p->family) {
		case AF_INET:
		if (p->sel.prefixlen_d > 32 \|\| p->sel.prefixlen_s > 32)
		goto out;

		break;

		case AF_INET6:
		#if IS_ENABLED(CONFIG_IPV6)
		if (p->sel.prefixlen_d > 128 \|\| p->sel.prefixlen_s > 128)
		goto out;

		break;
		#else
		err = -EAFNOSUPPORT;
		@@ -1359,10 +1365,16 @@ static int verify_newpolicy_info(struct xfrm_userpolicy_info *p)

		switch (p->sel.family) {
		case AF_INET:
		if (p->sel.prefixlen_d > 32 \|\| p->sel.prefixlen_s > 32)
		return -EINVAL;

		break;

		case AF_INET6:
		#if IS_ENABLED(CONFIG_IPV6)
		if (p->sel.prefixlen_d > 128 \|\| p->sel.prefixlen_s > 128)
		return -EINVAL;

		break;
		#else
		return -EAFNOSUPPORT;

Admin message