mirror of https://github.com/torvalds/linux.git
bee47cb026
Scott Mayhew discovered a security exploit in NFS over TLS in
tls_alert_recv() due to its assumption it can read data from
the msg iterator's kvec..
kTLS implementation splits TLS non-data record payload between
the control message buffer (which includes the type such as TLS
aler or TLS cipher change) and the rest of the payload (say TLS
alert's level/description) which goes into the msg payload buffer.
This patch proposes to rework how control messages are setup and
used by sock_recvmsg().
If no control message structure is setup, kTLS layer will read and
process TLS data record types. As soon as it encounters a TLS control
message, it would return an error. At that point, NFS can setup a
kvec backed msg buffer and read in the control message such as a
TLS alert. Msg iterator can advance the kvec pointer as a part of
the copy process thus we need to revert the iterator before calling
into the tls_alert_recv.
Reported-by: Scott Mayhew <smayhew@redhat.com>
Fixes:
|
||
|---|---|---|
| .. | ||
| auth_gss | ||
| xprtrdma | ||
| .kunitconfig | ||
| Kconfig | ||
| Makefile | ||
| addr.c | ||
| auth.c | ||
| auth_null.c | ||
| auth_tls.c | ||
| auth_unix.c | ||
| backchannel_rqst.c | ||
| cache.c | ||
| clnt.c | ||
| debugfs.c | ||
| fail.h | ||
| netns.h | ||
| rpc_pipe.c | ||
| rpcb_clnt.c | ||
| sched.c | ||
| socklib.c | ||
| socklib.h | ||
| stats.c | ||
| sunrpc.h | ||
| sunrpc_syms.c | ||
| svc.c | ||
| svc_xprt.c | ||
| svcauth.c | ||
| svcauth_unix.c | ||
| svcsock.c | ||
| sysctl.c | ||
| sysfs.c | ||
| sysfs.h | ||
| timer.c | ||
| xdr.c | ||
| xprt.c | ||
| xprtmultipath.c | ||
| xprtsock.c | ||