Skip to contentSkip to conversation

tools: hv: Netlink source address validation allows DoS

PATCH New Tomas Hozza 1 participant 1 message Nov 8, 2012 1 message not in the archive Hyper-V/Azure core and drivers

lore
Share & tools
lore

A message that is not in the archive (sent off-list or not yet received): [email protected]

Tomas Hozza

author
#1 lore raw

PATCH 1/1 tools: hv: Netlink source address validation allows DoS

The source code without this patch caused hypervkvpd to exit when it processed a spoofed Netlink packet which has been sent from an untrusted local user. Now Netlink messages with a non-zero nl_pid source address are ignored and a warning is printed into the syslog.

Signed-off-by Tomas Hozza <[email protected]>
---
 tools/hv/hv_kvp_daemon.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
tools/hv/hv_kvp_daemon.c +7 -1
index 13c2a14..c1d9102 100755
@@ -1486,13 +1486,19 @@ int main(void)
 		len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0,
 				addr_p, &addr_l);
 
-		if (len < 0 || addr.nl_pid) {
+		if (len < 0) {
 			syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s",
 					addr.nl_pid, errno, strerror(errno));
 			close(fd);
 			return -1;
 		}
 
+		if (addr.nl_pid) {
+			syslog(LOG_WARNING, "Received packet from untrusted pid:%u",
+					addr.nl_pid);
+			continue;
+		}
+
 		incoming_msg = (struct nlmsghdr *)kvp_recv_buffer;
 		incoming_cn_msg = (struct cn_msg *)NLMSG_DATA(incoming_msg);
 		hv_msg = (struct hv_kvp_msg *)incoming_cn_msg->data;
Signature · 1 line
1.7.11.7