TononixOS/ubports_kernel_google_msm
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

iscsi-target: fix heap buffer overflow on error

Browse Source 
CVE-2013-2850

commit cea4dcfdad926a27a18e188720efe0f2c9403456 upstream.

If a key was larger than 64 bytes, as checked by iscsi_check_key(), the
error response packet, generated by iscsi_add_notunderstood_response(),
would still attempt to copy the entire key into the packet, overflowing
the structure on the heap.

Remote preauthentication kernel memory corruption was possible if a
target was configured and listening on the network.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
This commit is contained in:
Kees Cook
2013-05-23 10:32:17 -07:00
committed by Tim Gardner
parent 0902ecf940
commit 5b06926f7a
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
drivers/target/iscsi/iscsi_target_parameters.c
View File

@@ -713,9 +713,9 @@ static int iscsi_add_notunderstood_response(
} }
INIT_LIST_HEAD(&extra_response->er_list); INIT_LIST_HEAD(&extra_response->er_list);
strncpy(extra_response->key, key, strlen(key) + 1); strlcpy(extra_response->key, key, sizeof(extra_response->key));
strncpy(extra_response->value, NOTUNDERSTOOD, strlcpy(extra_response->value, NOTUNDERSTOOD,
strlen(NOTUNDERSTOOD) + 1); sizeof(extra_response->value));
list_add_tail(&extra_response->er_list, list_add_tail(&extra_response->er_list,
&param_list->extra_response_list); &param_list->extra_response_list);
@@ -1571,8 +1571,6 @@ int iscsi_decode_text_input(
if (phase & PHASE_SECURITY) { if (phase & PHASE_SECURITY) {
if (iscsi_check_for_auth_key(key) > 0) { if (iscsi_check_for_auth_key(key) > 0) {
char *tmpptr = key + strlen(key);
*tmpptr = '=';
kfree(tmpbuf); kfree(tmpbuf);
return 1; return 1;
} }

4
drivers/target/iscsi/iscsi_target_parameters.h
View File

@@ -1,8 +1,10 @@
#ifndef ISCSI_PARAMETERS_H #ifndef ISCSI_PARAMETERS_H
#define ISCSI_PARAMETERS_H #define ISCSI_PARAMETERS_H
#include <scsi/iscsi_proto.h>
struct iscsi_extra_response { struct iscsi_extra_response {
char key[64]; char key[KEY_MAXLEN];
char value[32]; char value[32];
struct list_head er_list; struct list_head er_list;
} ____cacheline_aligned; } ____cacheline_aligned;