[BusyBox-cvs] busybox/networking/libiproute libnetlink.c,1.6,1.7

[Erik Andersen]

Update of /var/cvs/busybox/networking/libiproute
In directory nail:/tmp/cvs-serv14768/networking/libiproute

Modified Files:
	libnetlink.c 
Log Message:
Steve Grubb writes:

Hello,

Last November a bug was found in iproute. CAN-2003-0856 has more information.
Basically, netlink packets can come from any user. If a program performs action
based on netlink packets, they must be examined to make sure they came from the
place they are expected (the kernel).

Attached is a patch against pre8. Please apply this before releasing 1.00 final.
All users of busy box may be vulnerable to local attacks without it.

Best Regards,
Steve Grubb



Index: libnetlink.c
===================================================================
RCS file: /var/cvs/busybox/networking/libiproute/libnetlink.c,v
retrieving revision 1.6
retrieving revision 1.7
diff -u -d -r1.6 -r1.7
--- a/libnetlink.c	15 Mar 2004 08:28:56 -0000	1.6
+++ b/libnetlink.c	5 May 2004 07:05:32 -0000	1.7
@@ -161,7 +161,8 @@
 		while (NLMSG_OK(h, status)) {
 			int err;
 
-			if (h->nlmsg_pid != rth->local.nl_pid ||
+			if (nladdr.nl_pid != 0 ||
+			    h->nlmsg_pid != rth->local.nl_pid ||
 			    h->nlmsg_seq != rth->dump) {
 				if (junk) {
 					err = junk(&nladdr, h, arg2);
@@ -270,7 +271,8 @@
 				bb_error_msg_and_die("!!!malformed message: len=%d", len);
 			}
 
-			if (h->nlmsg_pid != rtnl->local.nl_pid ||
+			if (nladdr.nl_pid != peer ||
+			    h->nlmsg_pid != rtnl->local.nl_pid ||
 			    h->nlmsg_seq != seq) {
 				if (junk) {
 					l_err = junk(&nladdr, h, jarg);