84 lines
2.5 KiB
Diff
84 lines
2.5 KiB
Diff
From f83f793e1fac3df2dda737ab857099e27b983440 Mon Sep 17 00:00:00 2001
|
|
From: Hangyu Hua <hbh25y@gmail.com>
|
|
Date: Wed, 19 Jul 2023 22:52:35 +0000
|
|
Subject: [PATCH 1/1] net: tls: fix possible race condition between
|
|
do_tls_getsockopt_conf() and do_tls_setsockopt_conf()
|
|
|
|
ctx->crypto_send.info is not protected by lock_sock in
|
|
do_tls_getsockopt_conf(). A race condition between do_tls_getsockopt_conf()
|
|
and error paths of do_tls_setsockopt_conf() may lead to a use-after-free
|
|
or null-deref.
|
|
|
|
More discussion: https://lore.kernel.org/all/Y/ht6gQL+u6fj3dG@hog/
|
|
|
|
Fixes: 3c4d7559159b ("tls: kernel TLS support")
|
|
Signed-off-by: Hangyu Hua <hbh25y@gmail.com>
|
|
Link: https://lore.kernel.org/r/20230228023344.9623-1-hbh25y@gmail.com
|
|
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
|
|
(commit 49c47cc21b5b7a3d8deb18fc57b0aa2ab1286962 upstream)
|
|
|
|
Conflicts:
|
|
net/tls/tls_main.c
|
|
|
|
CVE: CVE-2023-28466
|
|
Signed-off-by: Mridula Shastry <mridula.c.shastry@oracle.com>
|
|
Reviewed-by: Bert Barbe <bert.barbe@oracle.com>
|
|
---
|
|
net/tls/tls_main.c | 9 +++++----
|
|
1 file changed, 5 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
|
|
index a4ca1bfaa..92909eeca 100644
|
|
--- a/net/tls/tls_main.c
|
|
+++ b/net/tls/tls_main.c
|
|
@@ -386,13 +386,11 @@ static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
|
|
rc = -EINVAL;
|
|
goto out;
|
|
}
|
|
- lock_sock(sk);
|
|
memcpy(crypto_info_aes_gcm_128->iv,
|
|
cctx->iv + TLS_CIPHER_AES_GCM_128_SALT_SIZE,
|
|
TLS_CIPHER_AES_GCM_128_IV_SIZE);
|
|
memcpy(crypto_info_aes_gcm_128->rec_seq, cctx->rec_seq,
|
|
TLS_CIPHER_AES_GCM_128_REC_SEQ_SIZE);
|
|
- release_sock(sk);
|
|
if (copy_to_user(optval,
|
|
crypto_info_aes_gcm_128,
|
|
sizeof(*crypto_info_aes_gcm_128)))
|
|
@@ -410,13 +408,11 @@ static int do_tls_getsockopt_conf(struct sock *sk, char __user *optval,
|
|
rc = -EINVAL;
|
|
goto out;
|
|
}
|
|
- lock_sock(sk);
|
|
memcpy(crypto_info_aes_gcm_256->iv,
|
|
cctx->iv + TLS_CIPHER_AES_GCM_256_SALT_SIZE,
|
|
TLS_CIPHER_AES_GCM_256_IV_SIZE);
|
|
memcpy(crypto_info_aes_gcm_256->rec_seq, cctx->rec_seq,
|
|
TLS_CIPHER_AES_GCM_256_REC_SEQ_SIZE);
|
|
- release_sock(sk);
|
|
if (copy_to_user(optval,
|
|
crypto_info_aes_gcm_256,
|
|
sizeof(*crypto_info_aes_gcm_256)))
|
|
@@ -436,6 +432,8 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
|
|
{
|
|
int rc = 0;
|
|
|
|
+ lock_sock(sk);
|
|
+
|
|
switch (optname) {
|
|
case TLS_TX:
|
|
case TLS_RX:
|
|
@@ -446,6 +444,9 @@ static int do_tls_getsockopt(struct sock *sk, int optname,
|
|
rc = -ENOPROTOOPT;
|
|
break;
|
|
}
|
|
+
|
|
+ release_sock(sk);
|
|
+
|
|
return rc;
|
|
}
|
|
|
|
--
|
|
2.39.3
|
|
|