: orinoco: Information leakage due to incorrect padding
Subsystems (3)
PATCH 1/1 : orinoco: Information leakage due to incorrect padding
orinoco: Information leakage due to incorrect padding
The orinoco driver can send uninitialized data exposing random pieces of the system memory. This happens because data is not padded with zeroes when its length needs to be increased.
Reported by Meder Kydyraliev <[email protected]>
Please try to get it to Linux 2.6.14 and maybe even 2.6.13.y. It's a security issue.
drivers/net/wireless/orinoco.c +9 -5
@@ -490,9 +490,14 @@ static int orinoco_xmit(struct sk_buff *return 0 ; } -/* Length of the packet body */ -/* FIXME: what if the skb is smaller than this? */ - len =max_t (int,skb->len -ETH_HLEN ,ETH_ZLEN -ETH_HLEN ); +/* Check packet length, pad short packets, round up odd length */ + len =max_t (int,ALIGN (skb->len,2 ),ETH_ZLEN ); +if (skb->len < len) { + skb =skb_padto (skb, len); +if (skb ==NULL ) + goto fail; + } + len -=ETH_HLEN ; eh = (struct ethhdr *)skb->data;
@@ -544,8 +549,7 @@ static int orinoco_xmit(struct sk_buff * p = skb->data; } -/* Round up for odd length packets */ - err =hermes_bap_pwrite (hw,USER_BAP , p,ALIGN (data_len,2 ), + err =hermes_bap_pwrite (hw,USER_BAP , p, data_len, txfid, data_off);if (err) { printk(KERN_ERR "%s: Error %d writing packet to BAP\n",
Signature · 9 lines
Regards, Pavel Roskin ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl
Quoted 5 lines · Pavel Roskin
orinoco: Information leakage due to incorrect padding
The orinoco driver can send uninitialized data exposing random pieces of the system memory. This happens because data is not padded with zeroes when its length needs to be increased.
Issue itself looks valid in the current implementation, but a better fix would be to just remove the padding.
drivers/net/wireless/orinoco.c static int orinoco_xmit(struct sk_buff * · line 496
Quoted 7 lines
drivers/net/wireless/orinoco.c +4
-3-/* Length of the packet body */ -/* FIXME: what if the skb is smaller than this? */ - len =max_t (int,skb->len -ETH_HLEN ,ETH_ZLEN -ETH_HLEN ); +/* Check packet length, pad short packets, round up odd length */ + len =max_t (int,ALIGN (skb->len,2 ),ETH_ZLEN ); +if (skb->len < len) { + skb =skb_padto (skb, len);
There is no ETH_ZLEN limit on IEEE 802.11 frames.
Signature · 7 lines
Jouni Malinen PGP id EFC895FA ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl
A message that is not in the archive (sent off-list or not yet received): [email protected]
Hi, Jouni!
Quoted 10 lines · Jouni Malinen
Quoted 5 lines · Pavel Roskin
orinoco: Information leakage due to incorrect padding
The orinoco driver can send uninitialized data exposing random pieces of the system memory. This happens because data is not padded with zeroes when its length needs to be increased.
Issue itself looks valid in the current implementation, but a better fix would be to just remove the padding.
Thank you! With you and Jean saying that, I'm pretty much reassured now :-)
I'll do it in Orinoco CVS soon and then I'll submit the patch.
The patch I posted is actually a simplified version of the patch actually applied to the orinoco CVS, to make it as safe as possible for Linux 2.6.14 inclusion.
Signature · 9 lines
Regards, Pavel Roskin ------------------------------------------------------- This SF.Net email is sponsored by: Power Architecture Resource Center: Free content, downloads, discussions, and more. http://solutions.newsforge.com/ibmarch.tmpl