linux/include
Mathias Krause ecd7918745 xfrm_user: ensure user supplied esn replay window is valid
The current code fails to ensure that the netlink message actually
contains as many bytes as the header indicates. If a user creates a new
state or updates an existing one but does not supply the bytes for the
whole ESN replay window, the kernel copies random heap bytes into the
replay bitmap, the ones happen to follow the XFRMA_REPLAY_ESN_VAL
netlink attribute. This leads to following issues:

1. The replay window has random bits set confusing the replay handling
   code later on.

2. A malicious user could use this flaw to leak up to ~3.5kB of heap
   memory when she has access to the XFRM netlink interface (requires
   CAP_NET_ADMIN).

Known users of the ESN replay window are strongSwan and Steffen's
iproute2 patch (<http://patchwork.ozlabs.org/patch/85962/>). The latter
uses the interface with a bitmap supplied while the former does not.
strongSwan is therefore prone to run into issue 1.

To fix both issues without breaking existing userland allow using the
XFRMA_REPLAY_ESN_VAL netlink attribute with either an empty bitmap or a
fully specified one. For the former case we initialize the in-kernel
bitmap with zero, for the latter we copy the user supplied bitmap. For
state updates the full bitmap must be supplied.

To prevent overflows in the bitmap length calculation the maximum size
of bmp_len is limited to 128 by this patch -- resulting in a maximum
replay window of 4096 packets. This should be sufficient for all real
life scenarios (RFC 4303 recommends a default replay window size of 64).

Cc: Steffen Klassert <steffen.klassert@secunet.com>
Cc: Martin Willi <martin@revosec.ch>
Cc: Ben Hutchings <bhutchings@solarflare.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2012-09-20 18:08:40 -04:00
..
acpi Merge branches 'delete-gts-bfs', 'misc', 'novell-bugzilla-757888-numa' and 'osc-pcie' into base 2012-08-03 00:31:23 -04:00
asm-generic mutex: Place lock in contended state after fastpath_lock failure 2012-08-13 18:46:54 +02:00
crypto
drm drm: Drop the NV12M and YUV420M formats 2012-09-13 12:38:10 +09:00
keys
linux xfrm_user: ensure user supplied esn replay window is valid 2012-09-20 18:08:40 -04:00
math-emu
media [media] v4l2: add core support for the new VIDIOC_ENUM_FREQ_BANDS ioctl 2012-07-30 20:23:05 -03:00
memory
misc
mtd
net ipv6: use net->rt_genid to check dst validity 2012-09-18 15:57:03 -04:00
pcmcia
ras
rdma Merge branches 'cma', 'cxgb4', 'misc', 'mlx4-sriov', 'mlx-cleanups', 'ocrdma' and 'qib' into for-linus 2012-07-22 23:26:17 -07:00
rxrpc
scsi Merge branch 'master' [vanilla Linus master] into libata-dev.git/upstream 2012-07-25 15:58:48 -04:00
sound ASoC: Additional updates for 3.6 2012-08-20 21:26:04 +02:00
target target: Remove unused se_cmd.cmd_spdtl 2012-08-21 14:27:35 -07:00
trace Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip 2012-08-03 10:57:20 -07:00
video video: da8xx-fb: configure FIFO threshold to reduce underflow errors 2012-07-29 01:11:09 +00:00
xen Revert "xen PVonHVM: move shared_info to MMIO before kexec" 2012-08-16 13:05:25 -04:00
Kbuild