tools: hv: Netlink source address validation allows DoS

PATCH In review Tomas Hozza 3 participants 5 messages Nov 8, 2012 – Nov 18, 2012 Hyper-V/Azure core and drivers

Share & tools

Tomas Hozza

author

2012-11-08 09:54 UTC #0 lore raw

PATCH 1/1 tools: hv: Netlink source address validation allows DoS

The source code without this patch caused hypervkvpd to exit when it processed a spoofed Netlink packet which has been sent from an untrusted local user. Now Netlink messages with a non-zero nl_pid source address are ignored and a warning is printed into the syslog.

Signed-off-by Tomas Hozza <[email protected]>

---
 tools/hv/hv_kvp_daemon.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

tools/hv/hv_kvp_daemon.c +7 -1

index 13c2a14..c1d9102 100755
@@ -1486,13 +1486,19 @@ int main(void)
 		len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0,
 				addr_p, &addr_l);
 
-		if (len < 0 || addr.nl_pid) {
+		if (len < 0) {
 			syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s",
 					addr.nl_pid, errno, strerror(errno));
 			close(fd);
 			return -1;
 		}
 
+		if (addr.nl_pid) {
+			syslog(LOG_WARNING, "Received packet from untrusted pid:%u",
+					addr.nl_pid);
+			continue;
+		}
+
 		incoming_msg = (struct nlmsghdr *)kvp_recv_buffer;
 		incoming_cn_msg = (struct cn_msg *)NLMSG_DATA(incoming_msg);
 		hv_msg = (struct hv_kvp_msg *)incoming_cn_msg->data;

Signature · 1 line

1.7.11.7

KY Srinivasan

Acked-by on v1 1/1

2012-11-08 13:19 UTC #1 lore raw

Quoted 11 lines

-----Original Message-----
From: Tomas Hozza [mailto:[email protected]]
Sent: Thursday, November 08, 2012 4:53 AM
To: [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; KY Srinivasan
Cc: Tomas Hozza
Subject: [PATCH] tools: hv: Netlink source address validation allows DoS

Quoted 6 lines

The source code without this patch caused hypervkvpd to exit when it processed a spoofed Netlink packet which has been sent from an untrusted local user. Now Netlink messages with a non-zero nl_pid source address are ignored and a warning is printed into the syslog.
Signed-off-by Tomas Hozza <[email protected]>

Acked-by K. Y. Srinivasan <[email protected]>

Quoted 35 lines

---
 tools/hv/hv_kvp_daemon.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

tools/hv/hv_kvp_daemon.c +7 -1

index 13c2a14..c1d9102 100755
@@ -1486,13 +1486,19 @@ int main(void)
 		len = recvfrom(fd, kvp_recv_buffer, sizeof(kvp_recv_buffer), 0,
 				addr_p, &addr_l);
 
-		if (len < 0 || addr.nl_pid) {
+		if (len < 0) {
 			syslog(LOG_ERR, "recvfrom failed; pid:%u error:%d %s",
 					addr.nl_pid, errno, strerror(errno));
 			close(fd);
 			return -1;
 		}
 
+		if (addr.nl_pid) {
+			syslog(LOG_WARNING, "Received packet from untrusted
 pid:%u",
+					addr.nl_pid);
+			continue;
+		}
+
 		incoming_msg = (struct nlmsghdr *)kvp_recv_buffer;
 		incoming_cn_msg = (struct cn_msg

*)NLMSG_DATA(incoming_msg);
hv_msg = (struct hv_kvp_msg *)incoming_cn_msg->data;
--
1.7.11.7

Greg KH

2012-11-15 23:39 UTC #2 lore raw

In reply to Tomas Hozza

tools/hv/hv_kvp_daemon.c

Quoted 13 lines · Tomas Hozza

The source code without this patch caused hypervkvpd to exit when it processed a spoofed Netlink packet which has been sent from an untrusted local user. Now Netlink messages with a non-zero nl_pid source address are ignored and a warning is printed into the syslog.
Signed-off-by Tomas Hozza <[email protected]>
Acked-by K. Y. Srinivasan <[email protected]>
---
 tools/hv/hv_kvp_daemon.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
tools/hv/hv_kvp_daemon.c +0 -0
index 13c2a14..c1d9102 100755

Why are you setting a .c file to executable permissions? Something is really wrong here...

greg k-h

Tomas Hozza

author

2012-11-16 07:22 UTC #3 lore raw

----- Original Message -----

Quoted 15 lines · Tomas Hozza

Quoted 14 lines
The source code without this patch caused hypervkvpd to exit when it processed
a spoofed Netlink packet which has been sent from an untrusted local user.
Now Netlink messages with a non-zero nl_pid source address are ignored
and a warning is printed into the syslog.
Signed-off-by Tomas Hozza <[email protected]>
Acked-by K. Y. Srinivasan <[email protected]>
---
 tools/hv/hv_kvp_daemon.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

Quoted 5 lines

tools/hv/hv_kvp_daemon.c
Quoted 2 lines
tools/hv/hv_kvp_daemon.c +0 -0
index 13c2a14..c1d9102 100755
Why are you setting a .c file to executable permissions? Something is really wrong here...

I'm sorry, this is a mistake and unfortunately I missed it. Permissions should be 0644. Will check more carefully next time.

Regards,

Tomas Hozza

author

2012-11-18 14:22 UTC #4 lore raw

In reply to Greg KH

Hello.

Just FYI there is already a CVE name CVE-2012-5532 for this issue.

Regards,
Tomas Hozza

----- Original Message -----

Quoted 24 lines · Tomas Hozza

tools/hv/hv_kvp_daemon.c
Quoted 16 lines
The source code without this patch caused hypervkvpd to exit when it processed
a spoofed Netlink packet which has been sent from an untrusted local user.
Now Netlink messages with a non-zero nl_pid source address are ignored
and a warning is printed into the syslog.
Signed-off-by Tomas Hozza <[email protected]>
Acked-by K. Y. Srinivasan <[email protected]>
---
 tools/hv/hv_kvp_daemon.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)
tools/hv/hv_kvp_daemon.c +0 -0
index 13c2a14..c1d9102 100755
Why are you setting a .c file to executable permissions? Something is
really wrong here...
greg k-h