Commit be20250c authored by Dan Rosenberg's avatar Dan Rosenberg Committed by David S. Miller
Browse files

ROSE: prevent heap corruption with bad facilities 



When parsing the FAC_NATIONAL_DIGIS facilities field, it's possible for
a remote host to provide more digipeaters than expected, resulting in
heap corruption.  Check against ROSE_MAX_DIGIS to prevent overflows, and
abort facilities parsing on failure.

Additionally, when parsing the FAC_CCITT_DEST_NSAP and
FAC_CCITT_SRC_NSAP facilities fields, a remote host can provide a length
of less than 10, resulting in an underflow in a memcpy size, causing a
kernel panic due to massive heap corruption.  A length of greater than
20 results in a stack overflow of the callsign array.  Abort facilities
parsing on these invalid length values.

Signed-off-by: default avatarDan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent d370af0e

net/rose/rose_subr.c

+16 −2
Original line number Diff line number Diff line
@@ -290,12 +290,17 @@ static int rose_parse_national(unsigned char *p, struct rose_facilities_struct * 
				facilities->source_ndigis = 0;

				facilities->dest_ndigis   = 0;

				for (pt = p + 2, lg = 0 ; lg < l ; pt += AX25_ADDR_LEN, lg += AX25_ADDR_LEN) {

					if (pt[6] & AX25_HBIT)

					if (pt[6] & AX25_HBIT) {

						if (facilities->dest_ndigis >= ROSE_MAX_DIGIS)

							return -1;

						memcpy(&facilities->dest_digis[facilities->dest_ndigis++], pt, AX25_ADDR_LEN);

					else

					} else {

						if (facilities->source_ndigis >= ROSE_MAX_DIGIS)

							return -1;

						memcpy(&facilities->source_digis[facilities->source_ndigis++], pt, AX25_ADDR_LEN);

					}

				}

			}

			p   += l + 2;

			n   += l + 2;

			len -= l + 2;
@@ -333,6 +338,11 @@ static int rose_parse_ccitt(unsigned char *p, struct rose_facilities_struct *fac 


		case 0xC0:

			l = p[1];



			/* Prevent overflows*/

			if (l < 10 || l > 20)

				return -1;



			if (*p == FAC_CCITT_DEST_NSAP) {

				memcpy(&facilities->source_addr, p + 7, ROSE_ADDR_LEN);

				memcpy(callsign, p + 12,   l - 10);
@@ -373,12 +383,16 @@ int rose_parse_facilities(unsigned char *p, 
			switch (*p) {

			case FAC_NATIONAL:		/* National */

				len = rose_parse_national(p + 1, facilities, facilities_len - 1);

				if (len < 0)

					return 0;

				facilities_len -= len + 1;

				p += len + 1;

				break;



			case FAC_CCITT:		/* CCITT */

				len = rose_parse_ccitt(p + 1, facilities, facilities_len - 1);

				if (len < 0)

					return 0;

				facilities_len -= len + 1;

				p += len + 1;

				break;

CRA Git | Maintained and supported by SUSTech CRA and CCSE