In xfrm4_remove_beet_encap(), when the BEET pseudo-header is present
(XFRM_MODE_SKB_CB(skb)->protocol == IPPROTO_BEETPH), two validation
flaws exist in option decapsulation:
1. optlen is checked against `optlen > 250` instead of `MAX_IPOPTLEN`
(40). Later, `iph->ihl += optlen / 4` adds up to 62 to the 4-bit
`iph->ihl` field (which starts at 5), wrapping the 4-bit unsigned
bitfield around 16 and producing a bogus IPv4 header length smaller
than 20 bytes.
2. Only `pskb_may_pull(skb, phlen)` is checked before `__skb_pull(skb,
phlen)` and `ip_fast_csum(skb_network_header(skb), iph->ihl)`. If the
trailing `optlen` bytes reside in non-linear skb fragments (or beyond
the packet), `ip_fast_csum()` reads `optlen` bytes past
`skb_tail_pointer(skb)`.
Cap `optlen` at `MAX_IPOPTLEN` (40) and ensure `pskb_may_pull(skb, phlen
+ optlen)` succeeds before pulling `phlen`.
Fixes: 0a69452cb45a ("[XFRM]: BEET mode")
Fixes: 227620e29509 ("[IPSEC]: Separate inner/outer mode processing on input")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
net/xfrm/xfrm_input.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 5ed87d51392a..3ed5fb0c755c 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -197,12 +197,12 @@ static int xfrm4_remove_beet_encap(struct xfrm_state *x, struct sk_buff *skb)
phlen = sizeof(*ph) + ph->padlen;
optlen = ph->hdrlen * 8 + (IPV4_BEET_PHMAXLEN - phlen);
- if (optlen < 0 || optlen & 3 || optlen > 250)
+ if (optlen < 0 || optlen & 3 || optlen > MAX_IPOPTLEN)
goto out;
XFRM_MODE_SKB_CB(skb)->protocol = ph->nexthdr;
- if (!pskb_may_pull(skb, phlen))
+ if (!pskb_may_pull(skb, phlen + optlen))
goto out;
__skb_pull(skb, phlen);
}
--
2.55.0.1082.g2b9226bbc0-goog