In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
af_packet: Don’t cast tpacket_hdr.tp_len to int in tpacket_parse_header().<\/p>\n
syzbot reported BUG() in sock_sendmsg_nosec(). [0]<\/p>\n
The problem is that tpacket_parse_header() casts user-provided
\ntpacket_hdr.tp_len, which is u32, to int.<\/p>\n
If the length is larger than INT_MAX, the following condition
\nin tpacket_parse_header() passes,<\/p>\n
if (unlikely(tp_len > size_max))<\/p>\n
and any negative value can be returned to the caller, up to
\nsock_sendmsg_nosec().<\/p>\n
The repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast
\nto -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec().<\/p>\n
*(uint64_t*)0x200000000008 = 0xfffffdef;
\n …
\n syscall(__NR_write, \/*fd=*\/r[0], \/*buf=*\/0x200000000000ul, \/*count=*\/1ul);<\/p>\n
Let’s define the local tp_len as u32 in tpacket_parse_header().<\/p>\n
[0]:
\nkernel BUG at net\/socket.c:803!
\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI
\nCPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMPT(full)
\nHardware name: Google Google Compute Engine\/Google Compute Engine, BIOS Google 07\/24\/2026
\nRIP: 0010:sock_sendmsg_nosec+0x145\/0x180 net\/socket.c:803
\nCode: 06 67 48 0f b9 3a eb 95 e8 e8 3a 22 f8 48 89 df 4c 89 f6 4c 89 e2 4d 89 fb 2e e8 32 a5 5c 16 e9 51 ff ff ff e8 cc 3a 22 f8 90 0b e8 c4 3a 22 f8 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28
\nRSP: 0018:ffffc90003aefb48 EFLAGS: 00010293
\nRAX: ffffffff89a578d4 RBX: ffff8880764c67c0 RCX: ffff88807fb23e80
\nRDX: 0000000000000000 RSI: 00000000fffffdef RDI: 00000000fffffdef
\nRBP: 00000000fffffdef R08: ffffc90003aef747 R09: 1ffff9200075dee8
\nR10: dffffc0000000000 R11: fffff5200075dee9 R12: 0000000000000001
\nR13: dffffc0000000000 R14: ffffc90003aefbc0 R15: ffffffff8aac4310
\nFS: 000055559101b400(0000) GS:ffff888124ce0000(0000) knlGS:0000000000000000
\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
\nCR2: 0000200000000210 CR3: 0000000073dca000 CR4: 00000000003526f0
\nCall Trace:<\/p>\n
__sock_sendmsg net\/socket.c:815 [inline]
\n sock_write_iter+0x2de\/0x3e0 net\/socket.c:1266
\n new_sync_write fs\/read_write.c:595 [inline]
\n vfs_write+0x612\/0xba0 fs\/read_write.c:687
\n ksys_write+0x150\/0x270 fs\/read_write.c:739
\n do_syscall_x64 arch\/x86\/entry\/syscall_64.c:61 [inline]
\n do_syscall_64+0x166\/0x520 arch\/x86\/entry\/syscall_64.c:84
\n entry_SYSCALL_64_after_hwframe+0x77\/0x7f
\nRIP: 0033:0x7f173130ecb9
\nCode: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
\nRSP: 002b:00007ffd67e44248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
\nRAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f173130ecb9
\nRDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003
\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd67e44388
\nR13: 0000000000000002 R14: 00002000000000c0 R15: 0000000000000002<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
af_packet: Don’t cast tpacket_hdr.tp_len to int in tpacket_parse_header().<\/p>\n
syzbot reported BUG() in sock_sendmsg_nosec(). [0]<\/p>\n
The<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29250","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29250","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29250"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29250"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29250"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}