From be8be2cb5f29a638bbdeda232966e42de10d52bc Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Thu, 8 Dec 2016 19:25:51 +0100 Subject: [PATCH] net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (CVE-2016-9793) --- debian/changelog | 1 + ...d-overflows-for-SO_-SND-RCV-BUFFORCE.patch | 49 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 51 insertions(+) create mode 100644 debian/patches/bugfix/all/net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch diff --git a/debian/changelog b/debian/changelog index 180b56ff7..413d1fe33 100644 --- a/debian/changelog +++ b/debian/changelog @@ -46,6 +46,7 @@ linux (4.8.12-1) UNRELEASED; urgency=medium [ Salvatore Bonaccorso ] * tipc: check minimum bearer MTU (CVE-2016-8632) * packet: fix race condition in packet_set_ring (CVE-2016-8655) + * net: avoid signed overflows for SO_{SND|RCV}BUFFORCE (CVE-2016-9793) -- Uwe Kleine-König Sun, 04 Dec 2016 21:16:06 +0100 diff --git a/debian/patches/bugfix/all/net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch b/debian/patches/bugfix/all/net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch new file mode 100644 index 000000000..15d28bdba --- /dev/null +++ b/debian/patches/bugfix/all/net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch @@ -0,0 +1,49 @@ +From: Eric Dumazet +Date: Fri, 2 Dec 2016 09:44:53 -0800 +Subject: net: avoid signed overflows for SO_{SND|RCV}BUFFORCE +Origin: https://git.kernel.org/linus/b98b0bc8c431e3ceb4b26b0dfc8db509518fb290 + +CAP_NET_ADMIN users should not be allowed to set negative +sk_sndbuf or sk_rcvbuf values, as it can lead to various memory +corruptions, crashes, OOM... + +Note that before commit 82981930125a ("net: cleanups in +sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF +and SO_RCVBUF were vulnerable. + +This needs to be backported to all known linux kernels. + +Again, many thanks to syzkaller team for discovering this gem. + +Signed-off-by: Eric Dumazet +Reported-by: Andrey Konovalov +Signed-off-by: David S. Miller +--- + net/core/sock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 5e3ca41..00a074d 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -715,7 +715,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, + val = min_t(u32, val, sysctl_wmem_max); + set_sndbuf: + sk->sk_userlocks |= SOCK_SNDBUF_LOCK; +- sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF); ++ sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF); + /* Wake up sending tasks if we upped the value. */ + sk->sk_write_space(sk); + break; +@@ -751,7 +751,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, + * returning the value we actually used in getsockopt + * is the most desirable behavior. + */ +- sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF); ++ sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF); + break; + + case SO_RCVBUFFORCE: +-- +2.1.4 + diff --git a/debian/patches/series b/debian/patches/series index fca2ec567..823640260 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -104,6 +104,7 @@ bugfix/all/vfio-pci-Fix-integer-overflows-bitmask-check.patch bugfix/all/mnt-Add-a-per-mount-namespace-limit-on-the-number-of.patch bugfix/all/tipc-check-minimum-bearer-MTU.patch bugfix/all/packet-fix-race-condition-in-packet_set_ring.patch +bugfix/all/net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch # ABI maintenance