Commit 742b04d0 authored by David Ahern's avatar David Ahern Committed by Steffen Klassert
Browse files

xfrm: Check for underflow in xfrm_state_mtu 



Leo Lin reported OOB write issue in esp component:

  xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned
  modulo-2^32 space using an attacker-influenced "header_len + authsize +
  net_adj" subtracted from a small "mtu" argument. A nobody user can
  install an IPv4 ESP tunnel SA with a large authentication key
  (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),
  configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a
  large value. When a single UDP datagram is then sent through the
  tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and
  esp_output() consumes it as a signed int via:

        padto      = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))
        esp.tfclen = padto - skb->len   (assigned to int)

  esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t
  when passed to memset() inside esp_output_fill_trailer(), producing a
  ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as
  "Write of size 18446744073709551537 at addr ffff888...".

Check for underflow and return 1. This causes the sendmsg attempt to
fail with ENETUNREACH.

Fixes: c5c25238 ("[XFRM]: Optimize MTU calculation")
Reported-by: default avatarLeo Lin <leo@depthfirst.com>
Assisted-by: Codex:26.506.31004
Signed-off-by: default avatarDavid Ahern <dahern@nvidia.com>
Signed-off-by: default avatarSteffen Klassert <steffen.klassert@secunet.com>
parent 7dbac768

net/xfrm/xfrm_state.c

+16 −3
Original line number Diff line number Diff line
@@ -3114,10 +3114,14 @@ u32 xfrm_state_mtu(struct xfrm_state *x, int mtu) 
	const struct xfrm_type *type = READ_ONCE(x->type);

	struct crypto_aead *aead;

	u32 blksize, net_adj = 0;

	u32 overhead, payload_mtu;



	if (x->km.state != XFRM_STATE_VALID ||

	    !type || type->proto != IPPROTO_ESP)

	    !type || type->proto != IPPROTO_ESP) {

		if (mtu <= x->props.header_len)

			return 1;

		return mtu - x->props.header_len;

	}



	aead = x->data;

	blksize = ALIGN(crypto_aead_blocksize(aead), 4);
@@ -3140,8 +3144,17 @@ u32 xfrm_state_mtu(struct xfrm_state *x, int mtu) 
		break;

	}



	return ((mtu - x->props.header_len - crypto_aead_authsize(aead) -

		 net_adj) & ~(blksize - 1)) + net_adj - 2;

	overhead = x->props.header_len + crypto_aead_authsize(aead) + net_adj;

	if (mtu <= overhead)

		return 1;



	payload_mtu = mtu - overhead;

	payload_mtu &= ~(blksize - 1);

	if (payload_mtu <= 2)

		return 1;



	return payload_mtu + net_adj - 2;



}

EXPORT_SYMBOL_GPL(xfrm_state_mtu);