diff options
| author | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-10-27 09:15:37 -0400 |
|---|---|---|
| committer | Paul Gortmaker <paul.gortmaker@windriver.com> | 2011-10-27 09:15:37 -0400 |
| commit | c1c3b7975246aa396b0a4879af6c935337a0e50f (patch) | |
| tree | 37578be813f1a5ed45c5abfad6dabc23b417850a | |
| parent | 129c997aae2045ee6f320611e9c0c491d0b602b8 (diff) | |
| download | longterm-queue-2.6.34-c1c3b7975246aa396b0a4879af6c935337a0e50f.tar.gz | |
add CVE-2011-2213 inet diag patch
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>
| -rw-r--r-- | queue/inet_diag-fix-inet_diag_bc_audit.patch | 74 | ||||
| -rw-r--r-- | queue/series | 1 |
2 files changed, 75 insertions, 0 deletions
diff --git a/queue/inet_diag-fix-inet_diag_bc_audit.patch b/queue/inet_diag-fix-inet_diag_bc_audit.patch new file mode 100644 index 0000000..b79682c --- /dev/null +++ b/queue/inet_diag-fix-inet_diag_bc_audit.patch @@ -0,0 +1,74 @@ +From 5244e06967b172e1298726465fd3073ba1cc6f9c Mon Sep 17 00:00:00 2001 +From: Eric Dumazet <eric.dumazet@gmail.com> +Date: Fri, 17 Jun 2011 16:25:39 -0400 +Subject: [PATCH] inet_diag: fix inet_diag_bc_audit() + +commit eeb1497277d6b1a0a34ed36b97e18f2bd7d6de0d upstream. + +A malicious user or buggy application can inject code and trigger an +infinite loop in inet_diag_bc_audit() + +Also make sure each instruction is aligned on 4 bytes boundary, to avoid +unaligned accesses. + +Reported-by: Dan Rosenberg <drosenberg@vsecurity.com> +Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com> + +diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c +index 7403b9b..99366cb 100644 +--- a/net/ipv4/inet_diag.c ++++ b/net/ipv4/inet_diag.c +@@ -437,7 +437,7 @@ static int valid_cc(const void *bc, int len, int cc) + return 0; + if (cc == len) + return 1; +- if (op->yes < 4) ++ if (op->yes < 4 || op->yes & 3) + return 0; + len -= op->yes; + bc += op->yes; +@@ -447,11 +447,11 @@ static int valid_cc(const void *bc, int len, int cc) + + static int inet_diag_bc_audit(const void *bytecode, int bytecode_len) + { +- const unsigned char *bc = bytecode; ++ const void *bc = bytecode; + int len = bytecode_len; + + while (len > 0) { +- struct inet_diag_bc_op *op = (struct inet_diag_bc_op *)bc; ++ const struct inet_diag_bc_op *op = bc; + + //printk("BC: %d %d %d {%d} / %d\n", op->code, op->yes, op->no, op[1].no, len); + switch (op->code) { +@@ -462,22 +462,20 @@ static int inet_diag_bc_audit(const void *bytecode, int bytecode_len) + case INET_DIAG_BC_S_LE: + case INET_DIAG_BC_D_GE: + case INET_DIAG_BC_D_LE: +- if (op->yes < 4 || op->yes > len + 4) +- return -EINVAL; + case INET_DIAG_BC_JMP: +- if (op->no < 4 || op->no > len + 4) ++ if (op->no < 4 || op->no > len + 4 || op->no & 3) + return -EINVAL; + if (op->no < len && + !valid_cc(bytecode, bytecode_len, len - op->no)) + return -EINVAL; + break; + case INET_DIAG_BC_NOP: +- if (op->yes < 4 || op->yes > len + 4) +- return -EINVAL; + break; + default: + return -EINVAL; + } ++ if (op->yes < 4 || op->yes > len + 4 || op->yes & 3) ++ return -EINVAL; + bc += op->yes; + len -= op->yes; + } +-- +1.7.7 + diff --git a/queue/series b/queue/series index 564b135..a7e165d 100644 --- a/queue/series +++ b/queue/series @@ -204,6 +204,7 @@ vmxnet3-Fix-inconsistent-LRO-state-after-initializat.patch # Content taken from v2.6.32.43 taskstats-don-t-allow-duplicate-entries-in-listener-.patch +inet_diag-fix-inet_diag_bc_audit.patch # Content taken from v2.6.32.44 gro-Only-reset-frag0-when-skb-can-be-pulled.patch |