Re: CVE-2024-49995: tipc: guard against string buffer overrun

[Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>]

Hi,

On 21/10/24 23:33, Greg Kroah-Hartman wrote:
> Description
> ===========
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> tipc: guard against string buffer overrun
> 
> Smatch reports that copying media_name and if_name to name_parts may
> overwrite the destination.
> 
>   .../bearer.c:166 bearer_name_validate() error: strcpy() 'media_name' too large for 'name_parts->media_name' (32 vs 16)
>   .../bearer.c:167 bearer_name_validate() error: strcpy() 'if_name' too large for 'name_parts->if_name' (1010102 vs 16)
> 
> This does seem to be the case so guard against this possibility by using
> strscpy() and failing if truncation occurs.
> 
> Introduced by commit b97bf3fd8f6a ("[TIPC] Initial merge")
> 
> Compile tested only.
> 
> The Linux kernel CVE team has assigned CVE-2024-49995 to this issue.
> 
> 

Looking at the fix commit with more lines around the fix:

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=6555a2a9212be6983d2319d65276484f7c5f431a&context=30


  	/* validate component parts of bearer name */
  	if ((media_len <= 1) || (media_len > TIPC_MAX_MEDIA_NAME) ||
  	    (if_len <= 1) || (if_len > TIPC_MAX_IF_NAME))
  		return 0;

  	/* return bearer name components, if necessary */
  	if (name_parts) {
-		strcpy(name_parts->media_name, media_name);
-		strcpy(name_parts->if_name, if_name);
+		if (strscpy(name_parts->media_name, media_name,
+			    TIPC_MAX_MEDIA_NAME) < 0)
+			return 0;
+		if (strscpy(name_parts->if_name, if_name,
+			    TIPC_MAX_IF_NAME) < 0)
+			return 0;
  	}
  	return 1;



both media_len and if_len have validation checks above the 
if(name_parts) check. So I think this patch just silences the static 
checker warnings.

Simon/Dan , could you please help confirming that ?

Thanks,
Harshit

> Affected and fixed versions
> ===========================
> 
> 	Fixed in 5.10.227 with commit e2b2558971e0
> 	Fixed in 5.15.168 with commit 54dae0e9063e
> 	Fixed in 6.1.113 with commit 80c0be7bcf94
> 	Fixed in 6.6.55 with commit 12d26aa7fd3c
> 	Fixed in 6.10.14 with commit 2ed7f42dfd3e
> 	Fixed in 6.11.3 with commit a18c7b239d02
> 	Fixed in 6.12-rc1 with commit 6555a2a9212b
> 
> Please see https://www.kernel.org for a full list of currently supported
> kernel versions by the kernel community.
> 
> Unaffected versions might change over time as fixes are backported to
> older supported kernel versions.  The official CVE entry at
> 	https://cve.org/CVERecord/?id=CVE-2024-49995
> will be updated if fixes are backported, please check that for the most
> up to date information about this issue.
> 
> 
> Affected files
> ==============
> 
> The file(s) affected by this issue are:
> 	net/tipc/bearer.c
> 
> 
> Mitigation
> ==========
> 
> The Linux kernel CVE team recommends that you update to the latest
> stable kernel version for this, and many other bugfixes.  Individual
> changes are never tested alone, but rather are part of a larger kernel
> release.  Cherry-picking individual commits is not recommended or
> supported by the Linux kernel community at all.  If however, updating to
> the latest release is impossible, the individual changes to resolve this
> issue can be found at these commits:
> 	https://git.kernel.org/stable/c/e2b2558971e02ca33eb637a8350d68a48b3e8e46
> 	https://git.kernel.org/stable/c/54dae0e9063ed23c9acf8d5ab9b18d3426a8ac18
> 	https://git.kernel.org/stable/c/80c0be7bcf940ce9308311575c3aff8983c9b97a
> 	https://git.kernel.org/stable/c/12d26aa7fd3cbdbc5149b6e516563478d575026e
> 	https://git.kernel.org/stable/c/2ed7f42dfd3edb387034128ca5b0f639836d4ddd
> 	https://git.kernel.org/stable/c/a18c7b239d02aafb791ae2c45226f6bb40641792
> 	https://git.kernel.org/stable/c/6555a2a9212be6983d2319d65276484f7c5f431a