Date: Sun, 6 Jun 2021 23:40:24 +0800 From: butt3rflyh4ck <butterflyhuangxx@...il.com> To: oss-security@...ts.openwall.com Subject: Re: Linux kernel: nfc: null ptr dereference in llcp_sock_getname Hi, the patch for this issue in upstream: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=4ac06a1e013cf5fdd963317ffd3b968560f33bba Regards, butt3rflyh4ck. On Tue, Jun 1, 2021 at 3:37 PM butt3rflyh4ck <butterflyhuangxx@...il.com> wrote: > > Hi, there was a null pointer dereference in llcp_sock_getname in > net/nfc/llcp_sock.c and reproduced it in linux-5.13.0-rc2. An > unprivileged user can trigger this bug and cause denial of service. > > #Root Cause > After creating an nfc socket, bind the address by calling bind(), if > LLCP_SAP_MAX was used as SAP, it cause the bind() failed and there > would set llcp_sock->service_name as NULL. > > Although bind() returns an error here, it does not affect calling > other socket functions. sock_getname() would invoke > llcp_sock_getname(), llcp_sock_getname copied service name from > llcp_sock->service_name by memcpy but llcp_sock->service_name is NULL. > > #Fix > the patch for this issue: > https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=4ac06a1e013c > > #CVE > CVE not assigned. > > #Credits > Active Defense Lab of Venustech. > > > > Regards, > butt3rflyh4ck. > > -- > Active Defense Lab of Venustech -- Active Defense Lab of Venustech
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.