Messages in this thread | | | Date | Thu, 31 Mar 2022 20:20:57 -0700 | From | Jakub Kicinski <> | Subject | Re: [PATCH net v2] net/tls: fix slab-out-of-bounds bug in decrypt_internal |
| |
On Thu, 31 Mar 2022 15:04:28 +0800 Ziyang Xuan wrote: > The memory size of tls_ctx->rx.iv for AES128-CCM is 12 setting in > tls_set_sw_offload(). The return value of crypto_aead_ivsize() > for "ccm(aes)" is 16. So memcpy() require 16 bytes from 12 bytes > memory space will trigger slab-out-of-bounds bug as following: > > ================================================================== > BUG: KASAN: slab-out-of-bounds in decrypt_internal+0x385/0xc40 [tls] > Read of size 16 at addr ffff888114e84e60 by task tls/10911
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Thanks!
| |