]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/commit
xfrm_user: uncoditionally validate esn replay attribute struct
authorFlorian Westphal <fw@strlen.de>
Mon, 12 Feb 2018 13:42:01 +0000 (14:42 +0100)
committerThadeu Lima de Souza Cascardo <cascardo@canonical.com>
Mon, 9 Apr 2018 13:41:54 +0000 (10:41 -0300)
commit75351d1a6f0a77933edaeb6b7a3e909ae0fa6920
treed95ed0ba9255ecb5a9d0a96e02f6445da1312b7a
parentfebe0f9c4b1da9c7f685b7f9960c968b9b91d8f6
xfrm_user: uncoditionally validate esn replay attribute struct

BugLink: http://bugs.launchpad.net/bugs/1762370
commit d97ca5d714a5334aecadadf696875da40f1fbf3e upstream.

The sanity test added in ecd7918745234 can be bypassed, validation
only occurs if XFRM_STATE_ESN flag is set, but rest of code doesn't care
and just checks if the attribute itself is present.

So always validate.  Alternative is to reject if we have the attribute
without the flag but that would change abi.

Reported-by: syzbot+0ab777c27d2bb7588f73@syzkaller.appspotmail.com
Cc: Mathias Krause <minipli@googlemail.com>
Fixes: ecd7918745234 ("xfrm_user: ensure user supplied esn replay window is valid")
Fixes: d8647b79c3b7e ("xfrm: Add user interface for esn and big anti-replay windows")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
net/xfrm/xfrm_user.c