RE: [PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOCAL_AUTH_CHUNKS

[JEAN Jeremy]

Dear all,

Attached is a proposed fix that relies on a code suggestion from Xin Long, but reworked to better handle all cases.
Does this look ok?
I verified experimentally on 8ba098e6b6ff that this fix solves the two bugs I reported.

Regards,
Jérémy

-----Message d'origine-----
De : Xin Long <lucien.xin@xxxxxxxxx>
Envoyé : vendredi 31 juillet 2026 17:27
À : Jun Yang <juny24602@xxxxxxxxx>; JEAN Jeremy <Jeremy.Jean@xxxxxxxxxxx>
Cc : netdev@xxxxxxxxxxxxxxx; Jun Yang <junvyyang@xxxxxxxxxxx>; stable@xxxxxxxxxx; TencentOS Corvus AI <corvus@xxxxxxxxxxx>; Marcelo Ricardo Leitner <marcelo.leitner@xxxxxxxxx>; David S. Miller <davem@xxxxxxxxxxxxx>; Eric Dumazet <edumazet@xxxxxxxxxx>; Jakub Kicinski <kuba@xxxxxxxxxx>; Paolo Abeni <pabeni@xxxxxxxxxx>; Simon Horman <horms@xxxxxxxxxx>; Vlad Yasevich <vladislav.yasevich@xxxxxx>; linux-sctp@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx
Objet : Re: [PATCH net] sctp: bound the auth_chunks copy length in SCTP_LOCAL_AUTH_CHUNKS

On Thu, Jul 30, 2026 at 5:02 AM Jun Yang <juny24602@xxxxxxxxx> wrote:
>
> From: Jun Yang <junvyyang@xxxxxxxxxxx>
>
> sctp_getsockopt_local_auth_chunks() copies ntohs(length) -
> sizeof(paramhdr) bytes out of ch->chunks without bounding the count.
> For an association ch is the fixed-size asoc->c.auth_chunks[] array
> (sizeof(struct sctp_paramhdr) + SCTP_AUTH_MAX_CHUNKS bytes), whose
> length field is restored from the received state cookie by
> sctp_unpack_cookie() and is not validated against the array size.  A
> cookie carrying an oversized length makes copy_to_user() read past the
> array (out-of-bounds read).
>
> Bound the chunk count to SCTP_AUTH_MAX_CHUNKS before the copy.  That
> is the most valid chunk bytes either source can hold, so legitimate
> output is unchanged, and it also covers a stored length smaller than
> the parameter header, which would otherwise underflow.
>
> Fixes: 65b07e5d0d09 ("[SCTP]: API updates to suport SCTP-AUTH
> extensions.")
> Cc: stable@xxxxxxxxxx
> Reported-by: TencentOS Corvus AI <corvus@xxxxxxxxxxx>
> Signed-off-by: Jun Yang <junvyyang@xxxxxxxxxxx>
> ---
>  net/sctp/socket.c | 6 ++++++
>  1 file changed, 6 insertions(+)
>
> diff --git a/net/sctp/socket.c b/net/sctp/socket.c index
> 9a6da4e0d741..3e9dacb772a0 100644
> --- a/net/sctp/socket.c
> +++ b/net/sctp/socket.c
> @@ -7109,6 +7109,12 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
>                 goto num;
>
>         num_chunks = ntohs(ch->param_hdr.length) - sizeof(struct
> sctp_paramhdr);
> +       /* asoc->c.auth_chunks[] holds at most SCTP_AUTH_MAX_CHUNKS bytes but its
> +        * length is restored from the state cookie and is not bounded here;
> +        * clamp so an oversized length cannot read past the array.
> +        */
> +       if (num_chunks > SCTP_AUTH_MAX_CHUNKS)
> +               num_chunks = SCTP_AUTH_MAX_CHUNKS;
>         if (len < sizeof(struct sctp_authchunks) + num_chunks)
>                 return -EINVAL;
>
> --
> 2.55.0
>
The issue requires sysctl net.sctp.cookie_hmac_alg=none, right?

If so, Jean Jeremy has reported two issues caused by the missing validation of the auth params in the cookie. We may need to validate all auth_random, auth_hmacs and auth_chunks in sctp_unpack_cookie().

Let's wait a bit and see if he proceeds with the fix I've suggested.

Thanks.
Les données à caractère personnel recueillies et traitées dans le cadre de cet échange, le sont à seule fin d’exécution d’une relation professionnelle et s’opèrent dans cette seule finalité et pour la durée nécessaire à cette relation. Si vous souhaitez faire usage de vos droits de consultation, de rectification et de suppression de vos données, veuillez contacter contact.rgpd@xxxxxxxxxxxxx. Si vous avez reçu ce message par erreur, nous vous remercions d’en informer l’expéditeur et de détruire le message. The personal data collected and processed during this exchange aims solely at completing a business relationship and is limited to the necessary duration of that relationship. If you wish to use your rights of consultation, rectification and deletion of your data, please contact: contact.rgpd@xxxxxxxxxxxxx. If you have received this message in error, we thank you for informing the sender and destroying the message.

Attachment: cookie-hmac-id-new.patch
Description: cookie-hmac-id-new.patch