f0rb1dd3n / Reptile

LKM Linux rootkit
2.59k stars 575 forks source link

Unsafe skb handling #22

Closed milabs closed 6 years ago

milabs commented 6 years ago

data = (char *)((unsigned char *)icmp_header + sizeof(struct icmphdr)); data = (char *)((unsigned char *)tcp_header + sizeof(struct tcphdr)); data = (char *)((unsigned char *)udp_header + sizeof(struct udphdr));

skb_header_pointer() must be used along with local on-stack copy of skb->data portion...

See the example: https://elixir.bootlin.com/linux/latest/source/net/bridge/netfilter/ebt_ip.c#L36

f0rb1dd3n commented 6 years ago

fixed in f667770