rpms
/
kernel
2
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

CVE-2013-4343 net: use-after-free TUNSETIFF (rhbz 1007733 1007741)

This commit is contained in:
Josh Boyer 2013-09-13 07:38:51 -04:00
parent df469fea41
commit 011edb0a96
2 changed files with 66 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
kernel.spec
View File

@ -788,6 +788,9 @@ Patch26000: acpi-pcie-hotplug-conflict.patch
#rhbz 1002351
Patch25100: crypto-fix-race-in-larval-lookup.patch
#CVE-2013-4343 rhbz 1007733 1007741
Patch25101: tuntap-correctly-handle-error-in-tun_set_iff.patch
# END OF PATCH DEFINITIONS
%endif
@ -1534,6 +1537,9 @@ ApplyPatch acpi-pcie-hotplug-conflict.patch
#rhbz1002351
ApplyPatch crypto-fix-race-in-larval-lookup.patch
#CVE-2013-4343 rhbz 1007733 1007741
ApplyPatch tuntap-correctly-handle-error-in-tun_set_iff.patch
# END OF PATCH APPLICATIONS
%endif
@ -2333,6 +2339,9 @@ fi
# ||----w |
# || ||
%changelog
* Fri Sep 13 2013 Josh Boyer <jwboyer@fedoraproject.org>
- CVE-2013-4343 net: use-after-free TUNSETIFF (rhbz 1007733 1007741)
* Thu Sep 12 2013 Josh Boyer <jwboyer@fedoraproject.org>
- Update HID CVE fixes to fix crash from lenovo-tpkbd driver (rhbz 1003998)

57
tuntap-correctly-handle-error-in-tun_set_iff.patch Normal file
View File

@ -0,0 +1,57 @@
From dff4e504b2addc8053fc47712d44a21f733ef51b Mon Sep 17 00:00:00 2001
From: Jason Wang <jasowang@redhat.com>
Date: Wed, 11 Sep 2013 18:09:48 +0800
Subject: [PATCH] tuntap: correctly handle error in tun_set_iff()
Commit c8d68e6be1c3b242f1c598595830890b65cea64a
(tuntap: multiqueue support) only call free_netdev() on error in
tun_set_iff(). This causes several issues:
- memory of tun security were leaked
- use after free since the flow gc timer was not deleted and the tfile
were not detached
This patch solves the above issues.
Reported-by: Wannes Rombouts <wannes.rombouts@epitech.eu>
Cc: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
drivers/net/tun.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index 71af122..68b9aa3 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1691,11 +1691,11 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
INIT_LIST_HEAD(&tun->disabled);
err = tun_attach(tun, file);
if (err < 0)
- goto err_free_dev;
+ goto err_free_flow;
err = register_netdevice(tun->dev);
if (err < 0)
- goto err_free_dev;
+ goto err_detach;
if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
device_create_file(&tun->dev->dev, &dev_attr_owner) ||
@@ -1739,7 +1739,12 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
strcpy(ifr->ifr_name, tun->dev->name);
return 0;
- err_free_dev:
+err_detach:
+ tun_detach_all(dev);
+err_free_flow:
+ tun_flow_uninit(tun);
+ security_tun_dev_free_security(tun->security);
+err_free_dev:
free_netdev(dev);
return err;
}
--
1.8.3.1