Mathias Krause 53bf146992 xfrm_user: ensure user supplied esn replay window is valid ... [ Upstream commit ecd7918745 ] The current code fails to ensure that the netlink message actually contains as many bytes as the header indicates. If a user creates a new state or updates an existing one but does not supply the bytes for the whole ESN replay window, the kernel copies random heap bytes into the replay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL netlink attribute. This leads to following issues: 1. The replay window has random bits set confusing the replay handling code later on. 2. A malicious user could use this flaw to leak up to ~3.5kB of heap memory when she has access to the XFRM netlink interface (requires CAP_NET_ADMIN). Known users of the ESN replay window are strongSwan and Steffen's iproute2 patch (<http://patchwork.ozlabs.org/patch/85962/>). The latter uses the interface with a bitmap supplied while the former does not. strongSwan is therefore prone to run into issue 1. To fix both issues without breaking existing userland allow using the XFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a fully specified one. For the former case we initialize the in-kernel bitmap with zero, for the latter we copy the user supplied bitmap. For state updates the full bitmap must be supplied. To prevent overflows in the bitmap length calculation the maximum size of bmp_len is limited to 128 by this patch -- resulting in a maximum replay window of 4096 packets. This should be sufficient for all real life scenarios (RFC 4303 recommends a default replay window size of 64). Signed-off-by: Mathias Krause <minipli@googlemail.com> Cc: Steffen Klassert <steffen.klassert@secunet.com> Cc: Martin Willi <martin@revosec.ch> Cc: Ben Hutchings <bhutchings@solarflare.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2012-10-13 05:38:41 +09:00
..
acpi	Merge branch 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/lenb/linux	2012-05-05 10:06:06 -07:00
asm-generic	mutex: Place lock in contended state after fastpath_lock failure	2012-10-02 10:30:21 -07:00
crypto	crypto: user - Fix lookup of algorithms with IV generator	2012-03-29 19:52:47 +08:00
drm	drm: Check for invalid cursor flags	2012-10-02 10:30:23 -07:00
keys
linux	xfrm_user: ensure user supplied esn replay window is valid	2012-10-13 05:38:41 +09:00
math-emu
media	Merge branch 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media	2012-05-14 11:23:37 -07:00
misc
mtd
net	xfrm: Workaround incompatibility of ESN and async crypto	2012-10-13 05:38:40 +09:00
pcmcia
rdma	Merge branches 'cma', 'cxgb3', 'cxgb4', 'ehca', 'iser', 'mad', 'nes', 'qib', 'srp' and 'srpt' into for-next	2012-03-19 09:50:33 -07:00
rxrpc
scsi	SCSI: libsas: fix taskfile corruption in sas_ata_qc_fill_rtf	2012-07-16 09:04:37 -07:00
sound	ALSA: hda - hide HDMI/ELD printks unless snd.debug=2	2012-04-10 14:53:55 +02:00
target	target: Add generation of LOGICAL BLOCK ADDRESS OUT OF RANGE	2012-08-09 08:31:26 -07:00
trace	tracing: Don't call page_to_pfn() if page is NULL	2012-10-02 10:30:08 -07:00
video	Merge branch 'platforms' of git://git.linaro.org/people/rmk/linux-arm	2012-03-27 18:17:02 -07:00
xen	xen/m2p: do not reuse kmap_op->dev_bus_addr	2012-10-02 10:30:06 -07:00
Kbuild