oss-security - Re: Linux kernel: nfc: null ptr dereference in llcp_sock

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CAFcO6XOoDp3LDitRWWg0O7uXtL0c7+zosg3_+qwXeB=PYaezxQ@mail.gmail.com>
Date: Tue, 8 Jun 2021 11:02:12 +0800
From: butt3rflyh4ck <butterflyhuangxx@...il.com>
To: oss-security@...ts.openwall.com
Subject: Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname

Hi, RedHat has assigned CVE-2021-3587 to this issue.


Regards,
 butt3rflyh4ck.


On Sun, Jun 6, 2021 at 11:40 PM butt3rflyh4ck
<butterflyhuangxx@...il.com> wrote:
>
> Hi, the patch for this issue in upstream:
>
> https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4ac06a1e013cf5fdd963317ffd3b968560f33bba
>
> Regards,
>  butt3rflyh4ck.
>
>
> On Tue, Jun 1, 2021 at 3:37 PM butt3rflyh4ck <butterflyhuangxx@...il.com> wrote:
> >
> >  Hi, there was a null pointer dereference in llcp_sock_getname in
> > net/nfc/llcp_sock.c and reproduced it in linux-5.13.0-rc2. An
> > unprivileged user can trigger this bug and cause denial of service.
> >
> > #Root Cause
> > After creating an nfc socket, bind the address by calling bind(), if
> > LLCP_SAP_MAX was used as SAP, it cause the bind() failed and there
> > would set llcp_sock->service_name  as NULL.
> >
> > Although bind() returns an error here, it does not affect calling
> > other socket functions. sock_getname() would invoke
> > llcp_sock_getname(), llcp_sock_getname copied service  name from
> > llcp_sock->service_name by memcpy but llcp_sock->service_name is NULL.
> >
> > #Fix
> > the patch for this issue:
> > https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=4ac06a1e013c
> >
> > #CVE
> > CVE not assigned.
> >
> > #Credits
> > Active Defense Lab of Venustech.
> >
> >
> >
> > Regards,
> >    butt3rflyh4ck.
> >
> > --
> > Active Defense Lab of Venustech
>
>
>
> --
> Active Defense Lab of Venustech



--
Active Defense Lab of Venustech

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.