sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (CVE-2017-9075)
This commit is contained in:
parent
35c1e8ae8d
commit
3253209d02
|
@ -414,6 +414,7 @@ linux (4.9.30-1) UNRELEASED; urgency=medium
|
|||
(CVE-2017-0605)
|
||||
* dccp/tcp: do not inherit mc_list from parent (CVE-2017-8890)
|
||||
* ipv6: Prevent overrun when parsing v6 header options (CVE-2017-9074)
|
||||
* sctp: do not inherit ipv6_{mc|ac|fl}_list from parent (CVE-2017-9075)
|
||||
|
||||
-- Ben Hutchings <ben@decadent.org.uk> Mon, 08 May 2017 21:11:08 +0200
|
||||
|
||||
|
|
34
debian/patches/bugfix/all/sctp-do-not-inherit-ipv6_-mc-ac-fl-_list-from-parent.patch
vendored
Normal file
34
debian/patches/bugfix/all/sctp-do-not-inherit-ipv6_-mc-ac-fl-_list-from-parent.patch
vendored
Normal file
|
@ -0,0 +1,34 @@
|
|||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Wed, 17 May 2017 07:16:40 -0700
|
||||
Subject: sctp: do not inherit ipv6_{mc|ac|fl}_list from parent
|
||||
Origin: https://git.kernel.org/linus/fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8
|
||||
Bug-Debian-Security: https://security-tracker.debian.org/tracker/CVE-2017-9075
|
||||
|
||||
SCTP needs fixes similar to 83eaddab4378 ("ipv6/dccp: do not inherit
|
||||
ipv6_mc_list from parent"), otherwise bad things can happen.
|
||||
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Tested-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/sctp/ipv6.c | 3 +++
|
||||
1 file changed, 3 insertions(+)
|
||||
|
||||
diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
|
||||
index 142b70e..f5b45b8 100644
|
||||
--- a/net/sctp/ipv6.c
|
||||
+++ b/net/sctp/ipv6.c
|
||||
@@ -677,6 +677,9 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk,
|
||||
newnp = inet6_sk(newsk);
|
||||
|
||||
memcpy(newnp, np, sizeof(struct ipv6_pinfo));
|
||||
+ newnp->ipv6_mc_list = NULL;
|
||||
+ newnp->ipv6_ac_list = NULL;
|
||||
+ newnp->ipv6_fl_list = NULL;
|
||||
|
||||
rcu_read_lock();
|
||||
opt = rcu_dereference(np->opt);
|
||||
--
|
||||
2.1.4
|
||||
|
|
@ -107,6 +107,7 @@ debian/time-mark-timer_stats-as-broken.patch
|
|||
bugfix/all/tracing-Use-strlcpy-instead-of-strcpy-in-__trace_fin.patch
|
||||
bugfix/all/dccp-tcp-do-not-inherit-mc_list-from-parent.patch
|
||||
bugfix/all/ipv6-prevent-overrun-when-parsing-v6-header-options.patch
|
||||
bugfix/all/sctp-do-not-inherit-ipv6_-mc-ac-fl-_list-from-parent.patch
|
||||
|
||||
# Fix exported symbol versions
|
||||
bugfix/ia64/revert-ia64-move-exports-to-definitions.patch
|
||||
|
|
Loading…
Reference in New Issue