Messages in this thread | | | Date | Fri, 1 Apr 2022 11:35:28 -0700 | Subject | Re: [PATCH 1/1] nl80211: Prevent out-of-bounds read when processing NL80211_ATTR_REG_ALPHA2 | From | Jeff Johnson <> |
| |
On 4/1/2022 3:50 AM, Lee Jones wrote: > Checks are presently in place in validate_nla() to ensure strings > greater than 2 are not passed in by the user which could potentially > cause issues. > > However, there is nothing to prevent userspace from only providing a > single (1) Byte as the data length parameter via nla_put(). If this > were to happen, it would cause an OOB read in regulatory_hint_user(), > since it makes assumptions that alpha2[0] and alpha2[1] will always be > accessible. > > Add an additional check, to ensure enough data has been allocated to > hold both Bytes. > > Cc: <stable@vger.kernel.org> > Cc: Johannes Berg <johannes@sipsolutions.net> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: Paolo Abeni <pabeni@redhat.com> > Cc: linux-wireless@vger.kernel.org > Cc: netdev@vger.kernel.org > Signed-off-by: Lee Jones <lee.jones@linaro.org> > --- > net/wireless/nl80211.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c > index ee1c2b6b69711..80a516033db36 100644 > --- a/net/wireless/nl80211.c > +++ b/net/wireless/nl80211.c > @@ -7536,6 +7536,10 @@ static int nl80211_req_set_reg(struct sk_buff *skb, struct genl_info *info) > if (!info->attrs[NL80211_ATTR_REG_ALPHA2]) > return -EINVAL; > > + if (nla_len(info->attrs[NL80211_ATTR_REG_ALPHA2]) != > + nl80211_policy[NL80211_ATTR_REG_ALPHA2].len) > + return -EINVAL; > + > data = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); > return regulatory_hint_user(data, user_reg_hint_type); > case NL80211_USER_REG_HINT_INDOOR:
LGTM
doesn't nl80211_set_reg() also have this issue? alpha2 = nla_data(info->attrs[NL80211_ATTR_REG_ALPHA2]); [...] rd->alpha2[0] = alpha2[0]; rd->alpha2[1] = alpha2[1];
| |