CVE-2017-5970 keep skb->dst around in presence of IP options (rhbz 1421638)
This commit is contained in:
parent
a6f750fdff
commit
05b5c9a513
|
@ -0,0 +1,47 @@
|
|||
From 34b2cef20f19c87999fff3da4071e66937db9644 Mon Sep 17 00:00:00 2001
|
||||
From: Eric Dumazet <edumazet@google.com>
|
||||
Date: Sat, 4 Feb 2017 11:16:52 -0800
|
||||
Subject: [PATCH] ipv4: keep skb->dst around in presence of IP options
|
||||
|
||||
Andrey Konovalov got crashes in __ip_options_echo() when a NULL skb->dst
|
||||
is accessed.
|
||||
|
||||
ipv4_pktinfo_prepare() should not drop the dst if (evil) IP options
|
||||
are present.
|
||||
|
||||
We could refine the test to the presence of ts_needtime or srr,
|
||||
but IP options are not often used, so let's be conservative.
|
||||
|
||||
Thanks to syzkaller team for finding this bug.
|
||||
|
||||
Fixes: d826eb14ecef ("ipv4: PKTINFO doesnt need dst reference")
|
||||
Signed-off-by: Eric Dumazet <edumazet@google.com>
|
||||
Reported-by: Andrey Konovalov <andreyknvl@google.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/ipv4/ip_sockglue.c | 9 ++++++++-
|
||||
1 file changed, 8 insertions(+), 1 deletion(-)
|
||||
|
||||
diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
|
||||
index 53ae0c6..9000117 100644
|
||||
--- a/net/ipv4/ip_sockglue.c
|
||||
+++ b/net/ipv4/ip_sockglue.c
|
||||
@@ -1238,7 +1238,14 @@ void ipv4_pktinfo_prepare(const struct sock *sk, struct sk_buff *skb)
|
||||
pktinfo->ipi_ifindex = 0;
|
||||
pktinfo->ipi_spec_dst.s_addr = 0;
|
||||
}
|
||||
- skb_dst_drop(skb);
|
||||
+ /* We need to keep the dst for __ip_options_echo()
|
||||
+ * We could restrict the test to opt.ts_needtime || opt.srr,
|
||||
+ * but the following is good enough as IP options are not often used.
|
||||
+ */
|
||||
+ if (unlikely(IPCB(skb)->opt.optlen))
|
||||
+ skb_dst_force(skb);
|
||||
+ else
|
||||
+ skb_dst_drop(skb);
|
||||
}
|
||||
|
||||
int ip_setsockopt(struct sock *sk, int level,
|
||||
--
|
||||
2.9.3
|
||||
|
|
@ -649,6 +649,9 @@ Patch860: 0001-sctp-avoid-BUG_ON-on-sctp_wait_for_sndbuf.patch
|
|||
#rhbz 1415397
|
||||
Patch861: w1-ds2490-USB-transfer-buffers-need-to-be-DMAable.patch
|
||||
|
||||
#CVE-2017-5970 rhbz 1421638
|
||||
Patch862: ipv4-keep-skb-dst-around-in-presence-of-IP-options.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
@ -2196,6 +2199,9 @@ fi
|
|||
#
|
||||
#
|
||||
%changelog
|
||||
* Mon Feb 13 2017 Justin M. Forbes <jforbes@fedoraproject.org>
|
||||
- CVE-2017-5970 keep skb->dst around in presence of IP options (rhbz 1421638)
|
||||
|
||||
* Thu Feb 9 2017 Peter Robinson <pbrobinson@fedoraproject.org>
|
||||
- Fix OOPSes in vc4 (Raspberry Pi)
|
||||
|
||||
|
|
Loading…
Reference in New Issue