Commit d97ca5d7 authored Feb 12, 2018 by Florian Westphal Committed by Steffen Klassert Feb 13, 2018

xfrm_user: uncoditionally validate esn replay attribute struct

The sanity test added in ecd79187 can be bypassed, validation
only occurs if XFRM_STATE_ESN flag is set, but rest of code doesn't care
and just checks if the attribute itself is present.

So always validate. Alternative is to reject if we have the attribute
without the flag but that would change abi.

Reported-by: <syzbot+0ab777c27d2bb7588f73@syzkaller.appspotmail.com>
Cc: Mathias Krause <minipli@googlemail.com>
Fixes: ecd79187 ("xfrm_user: ensure user supplied esn replay window is valid")
Fixes: d8647b79 ("xfrm: Add user interface for esn and big anti-replay windows")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

parent 2471c981

net/xfrm/xfrm_user.c

+8 −13

Original line number	Diff line number	Diff line
		@@ -121,9 +121,8 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
		struct nlattr *rt = attrs[XFRMA_REPLAY_ESN_VAL];
		struct xfrm_replay_state_esn *rs;

		if (p->flags & XFRM_STATE_ESN) {
		if (!rt)
		return -EINVAL;
		return (p->flags & XFRM_STATE_ESN) ? -EINVAL : 0;

		rs = nla_data(rt);

		@@ -133,10 +132,6 @@ static inline int verify_replay(struct xfrm_usersa_info *p,
		if (nla_len(rt) < (int)xfrm_replay_state_esn_len(rs) &&
		nla_len(rt) != sizeof(*rs))
		return -EINVAL;
		}

		if (!rt)
		return 0;

		/* As only ESP and AH support ESN feature. */
		if ((p->id.proto != IPPROTO_ESP) && (p->id.proto != IPPROTO_AH))

Admin message