Bug 833112 – Potential stack overflow in tipc_mon_rcv()

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Michał Górny 2022-02-11 08:57:58 UTC]

The CVE is still marked as reserved but the commit is in the latest releases:

```
commit 59ff7514f8c56f166aadca49bcecfa028e0ad50f
Author: Jon Maloy <[e-mail]>
Date:   Sat Feb 5 14:11:18 2022 -0500

    tipc: improve size validations for received domain records
    
    commit 9aa422ad326634b76309e8ff342c246800621216 upstream.
    
    The function tipc_mon_rcv() allows a node to receive and process
    domain_record structs from peer nodes to track their views of the
    network topology.
    
    This patch verifies that the number of members in a received domain
    record does not exceed the limit defined by MAX_MON_DOMAIN, something
    that may otherwise lead to a stack overflow.
    
    tipc_mon_rcv() is called from the function tipc_link_proto_rcv(), where
    we are reading a 32 bit message data length field into a uint16.  To
    avert any risk of bit overflow, we add an extra sanity check for this in
    that function.  We cannot see that happen with the current code, but
    future designers being unaware of this risk, may introduce it by
    allowing delivery of very large (> 64k) sk buffers from the bearer
    layer.  This potential problem was identified by Eric Dumazet.
    
    This fixes CVE-2022-0435
    
    Reported-by: Samuel Page <[e-mail]>
    Reported-by: Eric Dumazet <[e-mail]>
    Fixes: 35c55c9877f8 ("tipc: add neighbor monitoring framework")
    Signed-off-by: Jon Maloy <[e-mail]>
    Reviewed-by: Xin Long <[e-mail]>
    Reviewed-by: Samuel Page <[e-mail]>
    Reviewed-by: Eric Dumazet <[e-mail]>
    Signed-off-by: Linus Torvalds <[e-mail]>
    Signed-off-by: Greg Kroah-Hartman <[e-mail]>
```

[Comment 1 Michał Górny 2022-02-11 09:02:38 UTC]

The fix is in:

5.16.9
5.15.23
5.10.100
5.4.179
4.19.229
4.14.266
4.9.301

[Comment 2 Larry the Git Cow 2022-02-11 13:33:48 UTC]

The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=c86bfed4c150c1f915af7f6f39b6eccfede8a288

commit c86bfed4c150c1f915af7f6f39b6eccfede8a288
Author:     Mike Pagano <[e-mail]>
AuthorDate: 2022-02-11 13:33:41 +0000
Commit:     Mike Pagano <[e-mail]>
CommitDate: 2022-02-11 13:33:41 +0000

    sys-kernel/gentoo-sources: Linux version bumps and genpatches
    
    This addresses CVE-2022-0435
    
    Linux 5.16.9
    Linux 5.15.23
    Linux 5.10.100
    Linux 5.4.179
    Linux 4.19.229
    Linux 4.14.266
    Linux 4.9.301
    
    Bug: https://bugs.gentoo.org/833112
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Mike Pagano <[e-mail]>

 sys-kernel/gentoo-sources/Manifest                 | 21 ++++++++++++++++
 .../gentoo-sources/gentoo-sources-4.14.266.ebuild  | 28 ++++++++++++++++++++++
 .../gentoo-sources/gentoo-sources-4.19.229.ebuild  | 28 ++++++++++++++++++++++
 .../gentoo-sources/gentoo-sources-4.9.301.ebuild   | 28 ++++++++++++++++++++++
 .../gentoo-sources/gentoo-sources-5.10.100.ebuild  | 28 ++++++++++++++++++++++
 .../gentoo-sources/gentoo-sources-5.15.23.ebuild   | 28 ++++++++++++++++++++++
 .../gentoo-sources/gentoo-sources-5.16.9.ebuild    | 28 ++++++++++++++++++++++
 .../gentoo-sources/gentoo-sources-5.4.179.ebuild   | 28 ++++++++++++++++++++++
 8 files changed, 217 insertions(+)

[Comment 3 John Helmert III 2022-03-26 01:44:00 UTC]

All done!