kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/drivers/target/iscsi
History
Vincent Pelletier aba97ce870 scsi: target: iscsi: Use hex2bin instead of a re-implementation 
commit 1816494330 upstream.

This change has the following effects, in order of descreasing importance:

1) Prevent a stack buffer overflow

2) Do not append an unnecessary NULL to an anyway binary buffer, which
   is writing one byte past client_digest when caller is:
   chap_string_to_hex(client_digest, chap_r, strlen(chap_r));

The latter was found by KASAN (see below) when input value hes expected size
(32 hex chars), and further analysis revealed a stack buffer overflow can
happen when network-received value is longer, allowing an unauthenticated
remote attacker to smash up to 17 bytes after destination buffer (16 bytes
attacker-controlled and one null).  As switching to hex2bin requires
specifying destination buffer length, and does not internally append any null,
it solves both issues.

This addresses CVE-2018-14633.

Beyond this:

- Validate received value length and check hex2bin accepted the input, to log
  this rejection reason instead of just failing authentication.

- Only log received CHAP_R and CHAP_C values once they passed sanity checks.

==================================================================
BUG: KASAN: stack-out-of-bounds in chap_string_to_hex+0x32/0x60 [iscsi_target_mod]
Write of size 1 at addr ffff8801090ef7c8 by task kworker/0:0/1021

CPU: 0 PID: 1021 Comm: kworker/0:0 Tainted: G           O      4.17.8kasan.sess.connops+ #2
Hardware name: To be filled by O.E.M. To be filled by O.E.M./Aptio CRB, BIOS 5.6.5 05/19/2014
Workqueue: events iscsi_target_do_login_rx [iscsi_target_mod]
Call Trace:
 dump_stack+0x71/0xac
 print_address_description+0x65/0x22e
 ? chap_string_to_hex+0x32/0x60 [iscsi_target_mod]
 kasan_report.cold.6+0x241/0x2fd
 chap_string_to_hex+0x32/0x60 [iscsi_target_mod]
 chap_server_compute_md5.isra.2+0x2cb/0x860 [iscsi_target_mod]
 ? chap_binaryhex_to_asciihex.constprop.5+0x50/0x50 [iscsi_target_mod]
 ? ftrace_caller_op_ptr+0xe/0xe
 ? __orc_find+0x6f/0xc0
 ? unwind_next_frame+0x231/0x850
 ? kthread+0x1a0/0x1c0
 ? ret_from_fork+0x35/0x40
 ? ret_from_fork+0x35/0x40
 ? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]
 ? deref_stack_reg+0xd0/0xd0
 ? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]
 ? is_module_text_address+0xa/0x11
 ? kernel_text_address+0x4c/0x110
 ? __save_stack_trace+0x82/0x100
 ? ret_from_fork+0x35/0x40
 ? save_stack+0x8c/0xb0
 ? 0xffffffffc1660000
 ? iscsi_target_do_login+0x155/0x8d0 [iscsi_target_mod]
 ? iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]
 ? process_one_work+0x35c/0x640
 ? worker_thread+0x66/0x5d0
 ? kthread+0x1a0/0x1c0
 ? ret_from_fork+0x35/0x40
 ? iscsi_update_param_value+0x80/0x80 [iscsi_target_mod]
 ? iscsit_release_cmd+0x170/0x170 [iscsi_target_mod]
 chap_main_loop+0x172/0x570 [iscsi_target_mod]
 ? chap_server_compute_md5.isra.2+0x860/0x860 [iscsi_target_mod]
 ? rx_data+0xd6/0x120 [iscsi_target_mod]
 ? iscsit_print_session_params+0xd0/0xd0 [iscsi_target_mod]
 ? cyc2ns_read_begin.part.2+0x90/0x90
 ? _raw_spin_lock_irqsave+0x25/0x50
 ? memcmp+0x45/0x70
 iscsi_target_do_login+0x875/0x8d0 [iscsi_target_mod]
 ? iscsi_target_check_first_request.isra.5+0x1a0/0x1a0 [iscsi_target_mod]
 ? del_timer+0xe0/0xe0
 ? memset+0x1f/0x40
 ? flush_sigqueue+0x29/0xd0
 iscsi_target_do_login_rx+0x3bc/0x4c0 [iscsi_target_mod]
 ? iscsi_target_nego_release+0x80/0x80 [iscsi_target_mod]
 ? iscsi_target_restore_sock_callbacks+0x130/0x130 [iscsi_target_mod]
 process_one_work+0x35c/0x640
 worker_thread+0x66/0x5d0
 ? flush_rcu_work+0x40/0x40
 kthread+0x1a0/0x1c0
 ? kthread_bind+0x30/0x30
 ret_from_fork+0x35/0x40

The buggy address belongs to the page:
page:ffffea0004243bc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x17fffc000000000()
raw: 017fffc000000000 0000000000000000 0000000000000000 00000000ffffffff
raw: ffffea0004243c20 ffffea0004243ba0 0000000000000000 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801090ef680: f2 f2 f2 f2 f2 f2 f2 01 f2 f2 f2 f2 f2 f2 f2 00
 ffff8801090ef700: f2 f2 f2 f2 f2 f2 f2 00 02 f2 f2 f2 f2 f2 f2 00
>ffff8801090ef780: 00 f2 f2 f2 f2 f2 f2 00 00 f2 f2 f2 f2 f2 f2 00
                                              ^
 ffff8801090ef800: 00 f2 f2 f2 f2 f2 f2 00 00 00 00 02 f2 f2 f2 f2
 ffff8801090ef880: f2 f2 f2 00 00 00 00 00 00 00 00 f2 f2 f2 f2 00
==================================================================

Signed-off-by: Vincent Pelletier <plr.vincent@gmail.com>
Reviewed-by: Mike Christie <mchristi@redhat.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-10-03 04:10:08 +01:00
..
iscsi_target.c iscsi-target: Fix non-immediate TMR reference leak 2018-02-13 18:42:18 +00:00
iscsi_target.h iscsi/iser-target: Convert to command priv_size usage 2013-09-09 14:29:21 -07:00
iscsi_target_auth.c scsi: target: iscsi: Use hex2bin instead of a re-implementation 2018-10-03 04:10:08 +01:00
iscsi_target_auth.h iscsi-target: Fix CHAP_A parameter list handling 2014-06-05 19:44:02 -07:00
iscsi_target_configfs.c iscsi-target: Add login_keys_workaround attribute for non RFC initiators 2017-10-12 15:28:04 +01:00
iscsi_target_configfs.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_core.h iscsi-target: Fix iscsi_np reset hung task during parallel delete 2017-11-11 13:33:16 +00:00
iscsi_target_datain_values.c target: Update copyright ownership/year information to 2013 2013-09-10 20:23:36 -07:00
iscsi_target_datain_values.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_device.c iscsi-target: Fix mutex_trylock usage in iscsit_increment_maxcmdsn 2013-11-12 17:54:56 -08:00
iscsi_target_device.h target/iscsi: Remove unneeded wrapper functions 2012-02-25 14:37:47 -08:00
iscsi_target_erl0.c iscsi-target: Always wait for kthread_should_stop() before kthread exit 2017-09-15 18:29:53 +01:00
iscsi_target_erl0.h iscsi-target: Always wait for kthread_should_stop() before kthread exit 2017-09-15 18:29:53 +01:00
iscsi_target_erl1.c iscsi-target: Fix SNACK Type 1 + BegRun=0 handling 2014-02-12 15:11:17 -08:00
iscsi_target_erl1.h iscsit: use the itt_t abstract type 2012-10-03 14:21:50 -07:00
iscsi_target_erl2.c iscsi/iser-target: Use list_del_init for ->i_conn_node 2014-03-04 17:54:09 -08:00
iscsi_target_erl2.h iscsit: proper endianess conversions 2012-10-03 14:39:22 -07:00
iscsi_target_login.c iscsi-target: Fix iscsi_np reset hung task during parallel delete 2017-11-11 13:33:16 +00:00
iscsi_target_login.h iscsi-target: Fix iscsit_start_kthreads failure OOPs 2015-08-20 19:58:05 +01:00
iscsi_target_nego.c iscsi-target: Add login_keys_workaround attribute for non RFC initiators 2017-10-12 15:28:04 +01:00
iscsi_target_nego.h iscsi-target: Initial traditional TCP conversion to iscsit_transport 2013-04-25 01:05:26 -07:00
iscsi_target_nodeattrib.c iscsi-target: Expose default_erl as TPG attribute 2013-11-20 11:57:18 -08:00
iscsi_target_nodeattrib.h iscsi-target: Expose default_erl as TPG attribute 2013-11-20 11:57:18 -08:00
iscsi_target_parameters.c iscsi-target: Add login_keys_workaround attribute for non RFC initiators 2017-10-12 15:28:04 +01:00
iscsi_target_parameters.h iscsi-target: Add login_keys_workaround attribute for non RFC initiators 2017-10-12 15:28:04 +01:00
iscsi_target_seq_pdu_list.c target: Update copyright ownership/year information to 2013 2013-09-10 20:23:36 -07:00
iscsi_target_seq_pdu_list.h target/iscsi: Fold _decide_list_to_build into _build_pdu_and_seq_lists 2012-04-14 17:40:38 -07:00
iscsi_target_stat.c iscsi-target: Convert iscsi_session statistics to atomic_long_t 2013-11-19 21:38:52 -08:00
iscsi_target_stat.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_tmr.c target: Update copyright ownership/year information to 2013 2013-09-10 20:23:36 -07:00
iscsi_target_tmr.h iscsi-target: Add iSCSI fabric support for target v4.1 2011-07-26 09:16:43 +00:00
iscsi_target_tpg.c iscsi-target: Add login_keys_workaround attribute for non RFC initiators 2017-10-12 15:28:04 +01:00
iscsi_target_tpg.h iscsi-target: Add login_keys_workaround attribute for non RFC initiators 2017-10-12 15:28:04 +01:00
iscsi_target_tq.c iscsi-target: Drop problematic active_ts_list usage 2015-03-02 13:17:18 +00:00
iscsi_target_tq.h iscsi-target: Add thread_set->ts_activate_sem + use common deallocate 2013-09-10 20:23:05 -07:00
iscsi_target_transport.c iscsi-target: Add iscsit_transport API template 2013-04-25 01:05:26 -07:00
iscsi_target_util.c iscsi-target: Fix TMR reference leak during session shutdown 2017-07-18 18:40:26 +01:00
iscsi_target_util.h target: Add TFO->abort_task for aborted task resources release 2014-04-07 01:48:51 -07:00
Kconfig target: iscsi_target depends on NET 2011-07-28 20:16:18 +00:00
Makefile iscsi-target: Add iscsit_transport API template 2013-04-25 01:05:26 -07:00