On Thu, Nov 02, 2023 at 08:19:15PM +0100, Philipp Stanner wrote:
> In ppp_generic.c memdup_user() is utilized to copy a userspace array.
> This is done without an overflow check.
>
> Use the new wrapper memdup_array_user() to copy the array more safely.
> fprog.len = uprog->len;
> - fprog.filter = memdup_user(uprog->filter,
> - uprog->len * sizeof(struct sock_filter));
> + fprog.filter = memdup_array_user(uprog->filter,
> + uprog->len, sizeof(struct sock_filter));
Far be it from me to discourage security theat^Whardening, but
struct sock_fprog { /* Required for SO_ATTACH_FILTER. */
unsigned short len; /* Number of filter blocks */
struct sock_filter __user *filter;
};
struct sock_filter { /* Filter block */
__u16 code; /* Actual filter code */
__u8 jt; /* Jump true */
__u8 jf; /* Jump false */
__u32 k; /* Generic multiuse field */
};
so you might want to mention that overflow in question would have to be
in multiplying an untrusted 16bit value by 8...
