6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: Mashiro Chen nr_find_socket() dispatches incoming NR_INFO frames into a connected socket by matching the frame's circuit index/id pair (bytes[15-16]) against the socket's my_index/my_id. It performs no validation of the frame's source callsign against the socket's dest_addr. This means any node on the network can craft an NR_INFO frame with a guessed or brute-forced circuit index/id pair and have it accepted into an arbitrary STATE_3 connection as if it came from the legitimate peer. Circuit IDs are assigned sequentially starting at (1,1), making them predictable in practice. Combined with other receive path bugs, this lets a third party feed frames into a circuit it does not own. nr_find_peer() already checks the source address for CONNREQ; do the same for the other frame types. Fix by adding a source address parameter to nr_find_socket() and requiring it to match the socket's recorded dest_addr for all frame-dispatch lookups. The internal nr_find_next_circuit() caller, which only checks for circuit ID availability, passes NULL to skip the source check. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Mashiro Chen [F6BVP: rebased on mod-orphan; dropped the reference to an unassigned CVE from the changelog. Checked that every caller other than nr_find_next_circuit() is in nr_rx_frame() for non-CONNREQ frames, whose network source is the remote node recorded in dest_addr.] Signed-off-by: Bernard Pidoux (cherry picked from commit 70bf32b0eda85781a416cb929b7c6b4761abd2a8) Signed-off-by: Sasha Levin --- net/netrom/af_netrom.c | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/net/netrom/af_netrom.c b/net/netrom/af_netrom.c index 0e70d149abcd5..d9c484705c9e7 100644 --- a/net/netrom/af_netrom.c +++ b/net/netrom/af_netrom.c @@ -162,7 +162,8 @@ static struct sock *nr_find_listener(ax25_address *addr) /* * Find a connected NET/ROM socket given my circuit IDs. */ -static struct sock *nr_find_socket(unsigned char index, unsigned char id) +static struct sock *nr_find_socket(unsigned char index, unsigned char id, + const ax25_address *src) { struct sock *s; @@ -170,7 +171,8 @@ static struct sock *nr_find_socket(unsigned char index, unsigned char id) sk_for_each(s, &nr_list) { struct nr_sock *nr = nr_sk(s); - if (nr->my_index == index && nr->my_id == id) { + if (nr->my_index == index && nr->my_id == id && + (!src || !ax25cmp(&nr->dest_addr, src))) { sock_hold(s); goto found; } @@ -219,7 +221,8 @@ static unsigned short nr_find_next_circuit(void) j = id % 256; if (i != 0 && j != 0) { - if ((sk=nr_find_socket(i, j)) == NULL) + sk = nr_find_socket(i, j, NULL); + if (!sk) break; sock_put(sk); } @@ -928,7 +931,7 @@ int nr_rx_frame(struct sk_buff *skb, struct net_device *dev) if (frametype == NR_CONNREQ) sk = nr_find_peer(circuit_index, circuit_id, src); else - sk = nr_find_socket(circuit_index, circuit_id); + sk = nr_find_socket(circuit_index, circuit_id, src); } if (sk != NULL) { -- 2.53.0