From: Ben Hutchings <ben@decadent.org.uk>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: akpm@linux-foundation.org, "Neil Horman" <nhorman@tuxdriver.com>,
"Vlad Yasevich" <vyasevich@gmail.com>,
"Daniel Borkmann" <dborkman@redhat.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 3.2 20/27] net: sctp: fix memory leak in auth key management
Date: Mon, 29 Dec 2014 02:11:31 +0100 [thread overview]
Message-ID: <lsq.1419815491.598277997@decadent.org.uk> (raw)
In-Reply-To: <lsq.1419815490.288081487@decadent.org.uk>
3.2.66-rc1 review patch. If anyone has any objections, please let me know.
------------------
From: Daniel Borkmann <dborkman@redhat.com>
commit 4184b2a79a7612a9272ce20d639934584a1f3786 upstream.
A very minimal and simple user space application allocating an SCTP
socket, setting SCTP_AUTH_KEY setsockopt(2) on it and then closing
the socket again will leak the memory containing the authentication
key from user space:
unreferenced object 0xffff8800837047c0 (size 16):
comm "a.out", pid 2789, jiffies 4296954322 (age 192.258s)
hex dump (first 16 bytes):
01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 ................
backtrace:
[<ffffffff816d7e8e>] kmemleak_alloc+0x4e/0xb0
[<ffffffff811c88d8>] __kmalloc+0xe8/0x270
[<ffffffffa0870c23>] sctp_auth_create_key+0x23/0x50 [sctp]
[<ffffffffa08718b1>] sctp_auth_set_key+0xa1/0x140 [sctp]
[<ffffffffa086b383>] sctp_setsockopt+0xd03/0x1180 [sctp]
[<ffffffff815bfd94>] sock_common_setsockopt+0x14/0x20
[<ffffffff815beb61>] SyS_setsockopt+0x71/0xd0
[<ffffffff816e58a9>] system_call_fastpath+0x12/0x17
[<ffffffffffffffff>] 0xffffffffffffffff
This is bad because of two things, we can bring down a machine from
user space when auth_enable=1, but also we would leave security sensitive
keying material in memory without clearing it after use. The issue is
that sctp_auth_create_key() already sets the refcount to 1, but after
allocation sctp_auth_set_key() does an additional refcount on it, and
thus leaving it around when we free the socket.
Fixes: 65b07e5d0d0 ("[SCTP]: API updates to suport SCTP-AUTH extensions.")
Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
Cc: Vlad Yasevich <vyasevich@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
---
net/sctp/auth.c | 2 --
1 file changed, 2 deletions(-)
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -866,8 +866,6 @@ int sctp_auth_set_key(struct sctp_endpoi
list_add(&cur_key->key_list, sh_keys);
cur_key->key = key;
- sctp_auth_key_hold(key);
-
return 0;
nomem:
if (!replace)
next prev parent reply other threads:[~2014-12-29 1:13 UTC|newest]
Thread overview: 33+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-12-29 1:11 [PATCH 3.2 00/27] 3.2.66-rc1 review Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 05/27] ahci: disable MSI on SAMSUNG 0xa800 SSD Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 06/27] i2c: davinci: generate STP always when NACK is received Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 07/27] udf: Avoid infinite loop when processing indirect ICBs Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 23/27] tcp: md5: do not use alloc_percpu() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 14/27] deal with deadlock in d_walk() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 09/27] KVM: x86: Don't report guest userspace emulation error to userspace Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 19/27] drivers/net, ipv6: Select IPv6 fragment idents for virtio UFO packets Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 17/27] drm: fix DRM_IOCTL_MODE_GETFB handle-leak Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 04/27] mm: fix swapoff hang after page migration and fork Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 01/27] drm/i915: Unlock panel even when LVDS is disabled Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 26/27] net: sctp: use MAX_HEADER for headroom reserve in output path Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 18/27] crypto: ghash-clmulni-intel - use C implementation for setkey() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 27/27] x86: kvm: use alternatives for VMCALL vs. VMMCALL if kernel text is read-only Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 24/27] ipv4: dst_entry leak in ip_send_unicast_reply() Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 25/27] drivers/net: macvtap and tun depend on INET Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 03/27] sata_fsl: fix error handling of irq_of_parse_and_map Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 16/27] s390,time: revert direct ktime path for s390 clockevent device Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 10/27] x86/tls: Validate TLS entries to protect espfix Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 12/27] x86, kvm: Clear paravirt_enabled on KVM guests for espfix32's benefit Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 11/27] [media] ttusb-dec: buffer overflow in ioctl Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 02/27] AHCI: Add DeviceIDs for Sunrise Point-LP SATA controller Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 08/27] net: sctp: fix NULL pointer dereference in af->from_addr_param on malformed packet Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 13/27] move d_rcu from overlapping d_child to overlapping d_alias Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 22/27] tcp: md5: remove spinlock usage in fast path Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 21/27] ipv4: fix nexthop attlen check in fib_nh_match Ben Hutchings
2014-12-29 1:11 ` [PATCH 3.2 15/27] ext4: make orphan functions be no-op in no-journal mode Ben Hutchings
2014-12-29 1:11 ` Ben Hutchings [this message]
2014-12-29 1:14 ` [PATCH 3.2 00/27] 3.2.66-rc1 review Ben Hutchings
2014-12-29 9:39 ` Guenter Roeck
2014-12-29 11:28 ` Ben Hutchings
2014-12-30 0:26 ` Satoru Takeuchi
2014-12-30 1:56 ` Ben Hutchings
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=lsq.1419815491.598277997@decadent.org.uk \
--to=ben@decadent.org.uk \
--cc=akpm@linux-foundation.org \
--cc=davem@davemloft.net \
--cc=dborkman@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=stable@vger.kernel.org \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®