unimore/kernel-hacking-2024-linux-steffo
unimore/kernel-hacking-2024-linux-steffo
1
Fork 0
Code Pull requests 5 Wiki Activity

xfrm/compat: prevent potential spectre v1 gadget in xfrm_xlate32_attr()

Browse source 
int type = nla_type(nla);

  if (type > XFRMA_MAX) {
            return -EOPNOTSUPP;
  }

@type is then used as an array index and can be used
as a Spectre v1 gadget.

  if (nla_len(nla) < compat_policy[type].len) {

array_index_nospec() can be used to prevent leaking
content of kernel memory to malicious users.

Fixes: 5106f4a8ac ("xfrm/compat: Add 32=>64-bit messages translator")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Dmitry Safonov <dima@arista.com>
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Reviewed-by: Dmitry Safonov <dima@arista.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
This commit is contained in:
Eric Dumazet 2023-01-20 13:02:49 +00:00 committed by Steffen Klassert
parent eb6c59b735
commit b6ee896385
1 changed files with 2 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
net/xfrm/xfrm_compat.c
View file

@ -5,6 +5,7 @@
* Based on code and translator idea by: Florian Westphal <fw@strlen.de> * Based on code and translator idea by: Florian Westphal <fw@strlen.de>
*/ */
#include <linux/compat.h> #include <linux/compat.h>
#include <linux/nospec.h>
#include <linux/xfrm.h> #include <linux/xfrm.h>
#include <net/xfrm.h> #include <net/xfrm.h>
@ -437,6 +438,7 @@ static int xfrm_xlate32_attr(void *dst, const struct nlattr *nla,
NL_SET_ERR_MSG(extack, "Bad attribute"); NL_SET_ERR_MSG(extack, "Bad attribute");
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
type = array_index_nospec(type, XFRMA_MAX + 1);
if (nla_len(nla) < compat_policy[type].len) { if (nla_len(nla) < compat_policy[type].len) {
NL_SET_ERR_MSG(extack, "Attribute bad length"); NL_SET_ERR_MSG(extack, "Attribute bad length");
return -EOPNOTSUPP; return -EOPNOTSUPP;