linux-sctp.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
To: netdev@vger.kernel.org
Cc: linux-sctp@vger.kernel.org,
	Ilja Van Sprundel <ivansprundel@ioactive.com>,
	Neil Horman <nhorman@tuxdriver.com>,
	Vlad Yasevich <vyasevich@gmail.com>,
	Xin Long <lucien.xin@gmail.com>
Subject: [PATCH net 3/4] sctp: validate chunk size in __rcv_asconf_lookup
Date: Mon, 28 Jun 2021 16:13:43 -0300	[thread overview]
Message-ID: <136de038e69235a64a7331465951f0751d4d83bd.1624904195.git.marcelo.leitner@gmail.com> (raw)
In-Reply-To: <cover.1624904195.git.marcelo.leitner@gmail.com>

In one of the fallbacks that SCTP has for identifying an association for an
incoming packet, it looks for AddIp chunk (from ASCONF) and take a peek.
Thing is, at this stage nothing was validating that the chunk actually had
enough content for that, allowing the peek to happen over uninitialized
memory.

Similar check already exists in actual asconf handling in
sctp_verify_asconf().

Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
---
 net/sctp/input.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/sctp/input.c b/net/sctp/input.c
index f72bff93745c44be0dbfa29e754f2872a7d874c2..96dea8097dbeb4e29d537292d31dde5f02188389 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -1168,6 +1168,9 @@ static struct sctp_association *__sctp_rcv_asconf_lookup(
 	union sctp_addr_param *param;
 	union sctp_addr paddr;
 
+	if (ntohs(ch->length) < sizeof(*asconf) + sizeof(struct sctp_paramhdr))
+		return NULL;
+
 	/* Skip over the ADDIP header and find the Address parameter */
 	param = (union sctp_addr_param *)(asconf + 1);
 
-- 
2.31.1


  parent reply	other threads:[~2021-06-28 19:13 UTC|newest]

Thread overview: 8+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-28 19:13 [PATCH net 0/4] sctp: add some size validations Marcelo Ricardo Leitner
2021-06-28 19:13 ` [PATCH net 1/4] sctp: validate from_addr_param return Marcelo Ricardo Leitner
2021-07-27  2:20   ` Ben Hutchings
2021-07-27 15:10     ` Marcelo Ricardo Leitner
2021-06-28 19:13 ` [PATCH net 2/4] sctp: add size validation when walking chunks Marcelo Ricardo Leitner
2021-06-28 19:13 ` Marcelo Ricardo Leitner [this message]
2021-06-28 19:13 ` [PATCH net 4/4] sctp: add param size validation for SCTP_PARAM_SET_PRIMARY Marcelo Ricardo Leitner
2021-06-28 22:40 ` [PATCH net 0/4] sctp: add some size validations patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=136de038e69235a64a7331465951f0751d4d83bd.1624904195.git.marcelo.leitner@gmail.com \
    --to=marcelo.leitner@gmail.com \
    --cc=ivansprundel@ioactive.com \
    --cc=linux-sctp@vger.kernel.org \
    --cc=lucien.xin@gmail.com \
    --cc=netdev@vger.kernel.org \
    --cc=nhorman@tuxdriver.com \
    --cc=vyasevich@gmail.com \
    --subject='Re: [PATCH net 3/4] sctp: validate chunk size in __rcv_asconf_lookup' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).