Skip to contentSkip to conversation

ipvs: info leak in __ip_vs_get_dest_entries()

PATCH Applied Dan Carpenter 4 participants 6 messages Jun 3, 2013 – Jun 10, 2013

Subsystems (5)
Networking Network drivers Kernel janitors netfilter +1 more subsystems
lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 ipvs: info leak in __ip_vs_get_dest_entries()

The entry struct has a 2 byte hole after ->port and another 4 byte hole after ->stats.outpkts. You must have CAP_NET_ADMIN in your namespace to hit this information leak.

Signed-off-by Dan Carpenter <[email protected]>
net/netfilter/ipvs/ip_vs_ctl.c +1 -0
index df05c1c..e336535 100644
@@ -2542,6 +2542,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
 		struct ip_vs_dest *dest;
 		struct ip_vs_dest_entry entry;
 
+		memset(&entry, 0, sizeof(entry));
 		list_for_each_entry(dest, &svc->destinations, n_list) {
 			if (count >= get->num_dests)
 				break;
maintainer Acked-by on v1 1/1
#1 lore raw

Hello,

Quoted 5 lines · Dan Carpenter

The entry struct has a 2 byte hole after ->port and another 4 byte hole after ->stats.outpkts. You must have CAP_NET_ADMIN in your namespace to hit this information leak.

Signed-off-by Dan Carpenter <[email protected]>
Acked-by Julian Anastasov <[email protected]>

net/netfilter/ipvs/ip_vs_ctl.c __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get, · line 2548

Quoted 12 lines
net/netfilter/ipvs/ip_vs_ctl.c +1 -0
index df05c1c..e336535 100644
@@ -2542,6 +2542,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
 		struct ip_vs_dest *dest;
 		struct ip_vs_dest_entry entry;
 
+		memset(&entry, 0, sizeof(entry));
 		list_for_each_entry(dest, &svc->destinations, n_list) {
 			if (count >= get->num_dests)
 				break;

Regards

--
Julian Anastasov <[email protected]>

maintainer
#2 lore raw
In reply to Dan Carpenter
Quoted 3 lines · Dan Carpenter

The entry struct has a 2 byte hole after ->port and another 4 byte hole after ->stats.outpkts. You must have CAP_NET_ADMIN in your namespace to hit this information leak.

Hi Dan,

can I verify that it is actually possible to hit this and thus the patch is a -stable candidate?

Quoted 20 lines
Signed-off-by Dan Carpenter <[email protected]>
net/netfilter/ipvs/ip_vs_ctl.c +1 -1
index df05c1c..e336535 100644
@@ -2542,6 +2542,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
 		struct ip_vs_dest *dest;
 		struct ip_vs_dest_entry entry;
 
+		memset(&entry, 0, sizeof(entry));
 		list_for_each_entry(dest, &svc->destinations, n_list) {
 			if (count >= get->num_dests)
 				break;
--

To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

author
#3 lore raw
Quoted 9 lines · Simon Horman
Quoted 3 lines · Dan Carpenter

The entry struct has a 2 byte hole after ->port and another 4 byte hole after ->stats.outpkts. You must have CAP_NET_ADMIN in your namespace to hit this information leak.

Hi Dan,

can I verify that it is actually possible to hit this and thus the patch is a -stable candidate?

This is a static checker fix. To me it seems like it's obviously a real info leak.

I'm not certain of the impact though. CLONE_NEWNET requires CAP_SYS_ADMIN but on the other hand people are making virtualization products where they give everyone their own namespace with admin privileges.

regards,
dan carpenter

maintainer
#4 lore raw
In reply to Dan Carpenter
Quoted 5 lines · Dan Carpenter

The entry struct has a 2 byte hole after ->port and another 4 byte hole after ->stats.outpkts. You must have CAP_NET_ADMIN in your namespace to hit this information leak.

Signed-off-by Dan Carpenter <[email protected]>
Signed-off-by Simon Horman <[email protected]>

Pablo, could you take this directly into your tree.
If possible for v3.10. It also appears to be relevant for stable.

Quoted 18 lines
net/netfilter/ipvs/ip_vs_ctl.c +1 -1
index df05c1c..e336535 100644
@@ -2542,6 +2542,7 @@ __ip_vs_get_dest_entries(struct net *net, const struct ip_vs_get_dests *get,
 		struct ip_vs_dest *dest;
 		struct ip_vs_dest_entry entry;
 
+		memset(&entry, 0, sizeof(entry));
 		list_for_each_entry(dest, &svc->destinations, n_list) {
 			if (count >= get->num_dests)
 				break;
--

To unsubscribe from this list: send the line "unsubscribe netfilter-devel" in the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html

maintainer Applied
#5 lore raw
Quoted 10 lines · Simon Horman
Quoted 5 lines · Dan Carpenter

The entry struct has a 2 byte hole after ->port and another 4 byte hole after ->stats.outpkts. You must have CAP_NET_ADMIN in your namespace to hit this information leak.

Signed-off-by Dan Carpenter <[email protected]>
Signed-off-by Simon Horman <[email protected]>

Pablo, could you take this directly into your tree.

Applied, thanks Simon.

Quoted 1 line

If possible for v3.10. It also appears to be relevant for stable.

Sure, will do.