Linux Kernel setsockopt mcast_msfilter Integer Overflow Vulnerability

Linux Kernel setsockopt mcast_msfilter Integer Overflow Vulnerability

Vulnerability description:

The ip_setsockopt () contained in Linux kernel has an integer overflow. Local attackers can exploit this vulnerability to escalate privileges and obtain root privileges.
The ip_setsockopt () function is a sub-function called by the setsockopt (2) system. This function allows you to operate on multiple IP address set Interface Options, mcast_msfilter is used to provide a list of multicast addresses received by the kernel from the set interface. In ip_msfilter_size macro calculation, process the Interface Options of mcast_msfilterCodeInteger overflow exists.

 

 

 

Affected System:

Linux Kernel setsockopt mcast_msfilter

Linux Kernel 2.6.1
Linux Kernel 2.6.2
Linux Kernel 2.6.3
Linux Kernel 2.4.22
Linux Kernel 2.4.23
Linux Kernel 2.4.24
Linux Kernel 2.4.25

Does not affect the system:

Linux Kernel 2.4.26
Linux Kernel 2.6.4

Attack code:
(The vulnerability code exists in the net/IPv4/ip_sockglue.c file)

Case mcast_msfilter:
{
/*...*/
Msize = ip_msfilter_size (GSF-> gf_numsrc );
MSF = (struct ip_msfilter *) kmalloc (msize, gfp_kernel );
/*...*/
For (I = 0; I Gf_numsrc; ++ I ){
PSIN = (struct sockaddr_in *) & GSF-> gf_slist [I];
If (pSIN-> sin_family! = Af_inet)
Goto mc_msf_out;
MSF-> imsf_slist [I] = pSIN-> sin_addr.s_addr;
}

Whereas the ip_msfilter_size macro is defined as follows:

# Define ip_msfilter_size (numsrc )/
(Sizeof (struct ip_msfilter)-sizeof (_ u32 )/
+ (Numsrc) * sizeof (_ u32 ))

Security suggestions:

Download the security patches for Linux kernel 2.4.26 and 2.6.4:
Http://www.kernel.org