| From 42cd9f4416b7a6b6b54d365baf6075fa63428bc3 Mon Sep 17 00:00:00 2001 |
| From: Vasiliy Kulikov <segoon@openwall.com> |
| Date: Tue, 15 Mar 2011 13:37:13 +0100 |
| Subject: [PATCH] ipv6: netfilter: ip6_tables: fix infoleak to userspace |
| |
| commit 6a8ab060779779de8aea92ce3337ca348f973f54 upstream. |
| |
| Structures ip6t_replace, compat_ip6t_replace, and xt_get_revision are |
| copied from userspace. Fields of these structs that are |
| zero-terminated strings are not checked. When they are used as argument |
| to a format string containing "%s" in request_module(), some sensitive |
| information is leaked to userspace via argument of spawned modprobe |
| process. |
| |
| The first bug was introduced before the git epoch; the second was |
| introduced in 3bc3fe5e (v2.6.25-rc1); the third is introduced by |
| 6b7d31fc (v2.6.15-rc1). To trigger the bug one should have |
| CAP_NET_ADMIN. |
| |
| Signed-off-by: Vasiliy Kulikov <segoon@openwall.com> |
| Signed-off-by: Patrick McHardy <kaber@trash.net> |
| Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> |
| |
| diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c |
| index 9210e31..542edbf 100644 |
| --- a/net/ipv6/netfilter/ip6_tables.c |
| +++ b/net/ipv6/netfilter/ip6_tables.c |
| @@ -1325,6 +1325,7 @@ do_replace(struct net *net, const void __user *user, unsigned int len) |
| /* overflow check */ |
| if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters)) |
| return -ENOMEM; |
| + tmp.name[sizeof(tmp.name)-1] = 0; |
| |
| newinfo = xt_alloc_table_info(tmp.size); |
| if (!newinfo) |
| @@ -1871,6 +1872,7 @@ compat_do_replace(struct net *net, void __user *user, unsigned int len) |
| return -ENOMEM; |
| if (tmp.num_counters >= INT_MAX / sizeof(struct xt_counters)) |
| return -ENOMEM; |
| + tmp.name[sizeof(tmp.name)-1] = 0; |
| |
| newinfo = xt_alloc_table_info(tmp.size); |
| if (!newinfo) |
| @@ -2100,6 +2102,7 @@ do_ip6t_get_ctl(struct sock *sk, int cmd, void __user *user, int *len) |
| ret = -EFAULT; |
| break; |
| } |
| + rev.name[sizeof(rev.name)-1] = 0; |
| |
| if (cmd == IP6T_SO_GET_REVISION_TARGET) |
| target = 1; |
| -- |
| 1.7.4.4 |
| |
