From 90ff186d0adf8a438169f52a112e251c2f8364e5 Mon Sep 17 00:00:00 2001 From: Ben Hutchings Date: Sun, 24 Feb 2013 00:22:13 +0000 Subject: [PATCH] sock_diag: Fix out-of-bounds access to sock_diag_handlers[] svn path=/dists/trunk/linux/; revision=19843 --- debian/changelog | 1 + ...t-of-bounds-access-to-sock_diag_hand.patch | 33 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 35 insertions(+) create mode 100644 debian/patches/bugfix/all/sock_diag-Fix-out-of-bounds-access-to-sock_diag_hand.patch diff --git a/debian/changelog b/debian/changelog index 13a279ede..496ab5650 100644 --- a/debian/changelog +++ b/debian/changelog @@ -6,6 +6,7 @@ linux (3.8-1~experimental.1) UNRELEASED; urgency=low [ Ben Hutchings ] * aufs: Update to aufs3.x-rcN-20130204 + * sock_diag: Fix out-of-bounds access to sock_diag_handlers[] -- Ben Hutchings Tue, 19 Feb 2013 05:46:20 +0000 diff --git a/debian/patches/bugfix/all/sock_diag-Fix-out-of-bounds-access-to-sock_diag_hand.patch b/debian/patches/bugfix/all/sock_diag-Fix-out-of-bounds-access-to-sock_diag_hand.patch new file mode 100644 index 000000000..ec63421ca --- /dev/null +++ b/debian/patches/bugfix/all/sock_diag-Fix-out-of-bounds-access-to-sock_diag_hand.patch @@ -0,0 +1,33 @@ +From: Mathias Krause +Date: Sat, 23 Feb 2013 01:13:47 +0000 +Subject: sock_diag: Fix out-of-bounds access to sock_diag_handlers[] + +commit 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 upstream. + +Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY +with a family greater or equal then AF_MAX -- the array size of +sock_diag_handlers[]. The current code does not test for this +condition therefore is vulnerable to an out-of-bound access opening +doors for a privilege escalation. + +Signed-off-by: Mathias Krause +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +--- + net/core/sock_diag.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c +index 602cd63..750f44f 100644 +--- a/net/core/sock_diag.c ++++ b/net/core/sock_diag.c +@@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) + if (nlmsg_len(nlh) < sizeof(*req)) + return -EINVAL; + ++ if (req->sdiag_family >= AF_MAX) ++ return -EINVAL; ++ + hndl = sock_diag_lock_handler(req->sdiag_family); + if (hndl == NULL) + err = -ENOENT; diff --git a/debian/patches/series b/debian/patches/series index 65cb94217..2702d1c51 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -64,3 +64,4 @@ debian/mgag200-disable-autoload.patch bugfix/all/ath6kl-do-not-use-virt_addr_valid.patch features/all/xen/microcode-api-update.patch +bugfix/all/sock_diag-Fix-out-of-bounds-access-to-sock_diag_hand.patch