CVE-2013-7268 (C, published 2014-01-06T16:55Z)
Description: value: The ipx_recvmsg function in net/ipx/af_ipx.c in the Linux kernel before 3.12.4 updates a certain length value without ensuring that an associated data structure has been initialized, which allows local users to obtain sensitive information from kernel memory via a (1) recvfrom, (2) recvmmsg, or (3) recvmsg system call.
Severity: MEDIUM (CVSS v3 base score: )
Weakness: CWE-20 \u2014 Improper Input Validation
The product receives input or data, but it does
        not validate or incorrectly validates that the input has the
        properties that are required to process the data safely and
        correctly.
Repository: https://github.com/torvalds/linux
Files changed:
crypto/algif_hash.c
crypto/algif_skcipher.c
drivers/isdn/mISDN/socket.c
drivers/net/ppp/pppoe.c
include/linux/net.h
net/appletalk/ddp.c
net/atm/common.c
net/ax25/af_ax25.c
net/bluetooth/af_bluetooth.c
net/bluetooth/hci_sock.c
net/bluetooth/rfcomm/sock.c
net/bluetooth/sco.c
net/caif/caif_socket.c
net/compat.c
net/core/iovec.c
net/ipx/af_ipx.c
net/irda/af_irda.c
net/iucv/af_iucv.c
net/key/af_key.c
net/l2tp/l2tp_ppp.c
net/llc/af_llc.c
net/netlink/af_netlink.c
net/netrom/af_netrom.c
net/nfc/llcp_sock.c
net/nfc/rawsock.c
net/packet/af_packet.c
net/rds/recv.c
net/rose/af_rose.c
net/rxrpc/ar-recvmsg.c
net/socket.c
net/tipc/socket.c
net/unix/af_unix.c
net/vmw_vsock/af_vsock.c
net/vmw_vsock/vmci_transport.c
net/x25/af_x25.c
Commit message: net: rework recvmsg handler msg_name and msg_namelen logic

This patch now always passes msg->msg_namelen as 0. recvmsg handlers must
set msg_namelen to the proper size <= sizeof(struct sockaddr_storage)
to return msg_name to the user.

This prevents numerous uninitialized memory leaks we had in the
recvmsg handlers and makes it harder for new code to accidentally leak
uninitialized memory.

Optimize for the case recvfrom is called with NULL as address. We don't
need to copy the address at all, so set it to NULL before invoking the
recvmsg handler. We can do so, because all the recvmsg handlers must
cope with the case a plain read() is called on them. read() also sets
msg_name to NULL.

Also document these changes in include/linux/net.h as suggested by David
Miller.

Changes since RFC:

Set msg->msg_name = NULL if user specified a NULL in msg_name but had a
non-null msg_namelen in verify_iovec/verify_compat_iovec. This doesn't
affect sendto as it would bail out earlier while trying to copy-in the
address. It also more naturally reflects the logic by the callers of
verify_iovec.

With this change in place I could remove "
if (!uaddr || msg_sys->msg_namelen == 0)
	msg->msg_name = NULL
".

This change does not alter the user visible error logic as we ignore
msg_namelen as long as msg_name is NULL.

Also remove two unnecessary curly brackets in ___sys_recvmsg and change
comments to netdev style.

Cc: David Miller <davem@davemloft.net>
Suggested-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: David S. Miller <davem@davemloft.net>


Vulnerable code:
	msg->msg_namelen = 0;

	msg->msg_namelen = 0;
	struct sockaddr_mISDN	*maddr;
	if (msg->msg_namelen >= sizeof(struct sockaddr_mISDN)) {
		msg->msg_namelen = sizeof(struct sockaddr_mISDN);
		maddr = (struct sockaddr_mISDN *)msg->msg_name;
	} else {
		if (msg->msg_namelen)
			printk(KERN_WARNING "%s: too small namelen %d\n",
			       __func__, msg->msg_namelen);
		msg->msg_namelen = 0;
	m->msg_namelen = 0;

	struct sockaddr_at *sat = (struct sockaddr_at *)msg->msg_name;
	if (!err) {
		if (sat) {
			sat->sat_family      = AF_APPLETALK;
			sat->sat_port        = ddp->deh_sport;
			sat->sat_addr.s_node = ddp->deh_snode;
			sat->sat_addr.s_net  = ddp->deh_snet;
		}
		msg->msg_namelen = sizeof(*sat);
	msg->msg_namelen = 0;

	if (msg->msg_namelen != 0) {
		struct sockaddr_ax25 *sax = (struct sockaddr_ax25 *)msg->msg_name;
		if (sk->sk_shutdown & RCV_SHUTDOWN) {
			msg->msg_namelen = 0;
		}
		else
			msg->msg_namelen = 0;
	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

		msg->msg_namelen = 0;
		msg->msg_namelen = 0;
	m->msg_namelen = 0;

	msg->msg_namelen = 0;

		kern_msg->msg_name = kern_address;
		m->msg_name = address;
	msg->msg_namelen = sizeof(*sipx);

	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

	msg->msg_namelen = 0;
	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

	msg->msg_namelen = sizeof(*sax);

	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

	struct sockaddr_ll *sll;
	/*
	 *	If the address length field is there to be filled in, we fill
	 *	it in now.
	 */

	sll = &PACKET_SKB_CB(skb)->sa.ll;
	if (sock->type == SOCK_PACKET)
		msg->msg_namelen = sizeof(struct sockaddr_pkt);
	else
		msg->msg_namelen = sll->sll_halen + offsetof(struct sockaddr_ll, sll_addr);

	/*
	 *	You lose any data beyond the buffer you gave. If it worries a
	 *	user program they can ask the device for its MTU anyway.

	if (msg->msg_name)
	msg->msg_namelen = 0;

	struct sockaddr_rose *srose = (struct sockaddr_rose *)msg->msg_name;
	if (srose != NULL) {
		memset(srose, 0, msg->msg_namelen);
			if (msg->msg_name && msg->msg_namelen > 0)
				       &call->conn->trans->peer->srx,
				       sizeof(call->conn->trans->peer->srx));
	msg.msg_name = (struct sockaddr *)&address;
	msg.msg_namelen = sizeof(address);
	/*
	 *      Save the user-mode address (verify_iovec will change the
	 *      kernel msghdr to use the kernel address space)

	if (MSG_CMSG_COMPAT & flags) {
	} else
	/* will be updated in set_orig_addr() if needed */
	m->msg_namelen = 0;

	/* will be updated in set_orig_addr() if needed */
	m->msg_namelen = 0;

	msg->msg_namelen = 0;
	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

	msg->msg_namelen = 0;

	msg->msg_namelen = sizeof(struct sockaddr_x25);


Fixed code:
	if (msg->msg_name) {
		struct sockaddr_mISDN *maddr = msg->msg_name;

		msg->msg_namelen = sizeof(*maddr);
	/* Notes for implementing recvmsg:
	 * ===============================
	 * msg->msg_namelen should get updated by the recvmsg handlers
	 * iff msg_name != NULL. It is by default 0 to prevent
	 * returning uninitialized memory to user space.  The recvfrom
	 * handlers can assume that msg.msg_name is either NULL or has
	 * a minimum size of sizeof(struct sockaddr_storage).
	 */
	if (!err && msg->msg_name) {
		struct sockaddr_at *sat = msg->msg_name;
		sat->sat_family      = AF_APPLETALK;
		sat->sat_port        = ddp->deh_sport;
		sat->sat_addr.s_node = ddp->deh_snode;
		sat->sat_addr.s_net  = ddp->deh_snet;
		msg->msg_namelen     = sizeof(*sat);
	if (msg->msg_name) {
		struct sockaddr_ax25 *sax = msg->msg_name;
		if (sk->sk_shutdown & RCV_SHUTDOWN)

		if (kern_msg->msg_name)
			kern_msg->msg_name = kern_address;
		if (m->msg_name)
			m->msg_name = address;
		msg->msg_namelen	= sizeof(*sipx);
		msg->msg_namelen = sizeof(*sax);
	/* You lose any data beyond the buffer you gave. If it worries
	 * a user program they can ask the device for its MTU
	 * anyway.
	if (msg->msg_name) {
		/* If the address length field is there to be filled
		 * in, we fill it in now.
		 */
		if (sock->type == SOCK_PACKET) {
			msg->msg_namelen = sizeof(struct sockaddr_pkt);
		} else {
			struct sockaddr_ll *sll = &PACKET_SKB_CB(skb)->sa.ll;
			msg->msg_namelen = sll->sll_halen +
				offsetof(struct sockaddr_ll, sll_addr);
		}
	}
	if (msg->msg_name) {
		struct sockaddr_rose *srose;

		memset(msg->msg_name, 0, sizeof(struct full_sockaddr_rose));
		srose = msg->msg_name;
			if (msg->msg_name) {
				size_t len =
					sizeof(call->conn->trans->peer->srx);
				       &call->conn->trans->peer->srx, len);
				msg->msg_namelen = len;
			}
	/* Save some cycles and don't copy the address if not needed */
	msg.msg_name = addr ? (struct sockaddr *)&address : NULL;
	/* We assume all kernel code knows the size of sockaddr_storage */
	msg.msg_namelen = 0;
	/* Save the user-mode address (verify_iovec will change the
	 * kernel msghdr to use the kernel address space)
	if (MSG_CMSG_COMPAT & flags)
	else
	/* We assume all kernel code knows the size of sockaddr_storage */
	msg_sys->msg_namelen = 0;

		msg->msg_namelen = sizeof(*sx25);