Re: CVE-2024-49995: tipc: guard against string buffer overrun

[Dan Carpenter <dan.carpenter@linaro.org>]

On Thu, Apr 24, 2025 at 11:41:01AM +0530, Harshit Mogalapalli wrote:
> Hi,
> 
> On 21/10/24 23:33, Greg Kroah-Hartman wrote:
> > Description
> > ===========
> > 
> > In the Linux kernel, the following vulnerability has been resolved:
> > 
> > tipc: guard against string buffer overrun
> > 
> > Smatch reports that copying media_name and if_name to name_parts may
> > overwrite the destination.
> > 
> >   .../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16)
> >   .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16)
> > 
> > This does seem to be the case so guard against this possibility by using
> > strscpy() and failing if truncation occurs.
> > 
> > Introduced by commit b97bf3fd8f6a ("[TIPC] Initial merge")
> > 
> > Compile tested only.
> > 
> > The Linux kernel CVE team has assigned CVE-2024-49995 to this issue.
> > 
> > 
> 
> Looking at the fix commit with more lines around the fix:
> 
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6555a2a9212be6983d2319d65276484f7c5f431a&context=30
> 
> 
>  	/* validate component parts of bearer name */
>  	if ((media_len <= 1) || (media_len > TIPC_MAX_MEDIA_NAME) ||
>  	    (if_len <= 1) || (if_len > TIPC_MAX_IF_NAME))
>  		return 0;
> 
>  	/* return bearer name components, if necessary */
>  	if (name_parts) {
> -		strcpy(name_parts->media_name, media_name);
> -		strcpy(name_parts->if_name, if_name);
> +		if (strscpy(name_parts->media_name, media_name,
> +			    TIPC_MAX_MEDIA_NAME) < 0)
> +			return 0;
> +		if (strscpy(name_parts->if_name, if_name,
> +			    TIPC_MAX_IF_NAME) < 0)
> +			return 0;
>  	}
>  	return 1;
> 
> 
> 
> both media_len and if_len have validation checks above the if(name_parts)
> check. So I think this patch just silences the static checker warnings.
> 
> Simon/Dan , could you please help confirming that ?

Correct.  The "validate component parts of bearer name" checks are
sufficient.  This will not affect runtime.

regards,
dan carpenter