CVE-2013-4348 net: deadloop path in skb_flow_dissect (rhbz 1007939 1025647)
This commit is contained in:
Josh Boyer
parent
67bd5d9e34
commit
70f3dba04a
|
|
@ -788,6 +788,9 @@ Patch25137: cifs-Allow-LANMAN-auth-for-unencapsulated-auth-methods.patch
|
|||
#rhbz 995782
|
||||
Patch25138: intel-3.12-stable-fixes.patch
|
||||
|
||||
#CVE-2013-4348 rhbz 1007939 1025647
|
||||
Patch25139: net-flow_dissector-fail-on-evil-iph-ihl.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -1524,6 +1527,9 @@ ApplyPatch cifs-Allow-LANMAN-auth-for-unencapsulated-auth-methods.patch
|
|||
#rhbz 995782
|
||||
ApplyPatch intel-3.12-stable-fixes.patch
|
||||
|
||||
#CVE-2013-4348 rhbz 1007939 1025647
|
||||
ApplyPatch net-flow_dissector-fail-on-evil-iph-ihl.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
|
@ -2336,6 +2342,9 @@ fi
|
|||
# and build.
|
||||
|
||||
%changelog
|
||||
* Fri Nov 01 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- CVE-2013-4348 net: deadloop path in skb_flow_dissect (rhbz 1007939 1025647)
|
||||
|
||||
* Thu Oct 31 2013 Josh Boyer <jwboyer@fedoraprorject.org>
|
||||
- Fix display regression on Dell XPS 13 machines (rhbz 995782)
|
||||
|
||||
|
|
|
|||
|
|
@ -0,0 +1,82 @@
|
|||
Path: news.gmane.org!not-for-mail
|
||||
From: Jason Wang <jasowang@redhat.com>
|
||||
Newsgroups: gmane.linux.kernel,gmane.linux.network
|
||||
Subject: [PATCH net] net: flow_dissector: fail on evil iph->ihl
|
||||
Date: Fri, 1 Nov 2013 15:01:10 +0800
|
||||
Lines: 34
|
||||
Approved: news@gmane.org
|
||||
Message-ID: <1383289270-18952-1-git-send-email-jasowang@redhat.com>
|
||||
NNTP-Posting-Host: plane.gmane.org
|
||||
X-Trace: ger.gmane.org 1383289296 18578 80.91.229.3 (1 Nov 2013 07:01:36 GMT)
|
||||
X-Complaints-To: usenet@ger.gmane.org
|
||||
NNTP-Posting-Date: Fri, 1 Nov 2013 07:01:36 +0000 (UTC)
|
||||
Cc: Jason Wang <jasowang@redhat.com>,
|
||||
Petr Matousek <pmatouse@redhat.com>,
|
||||
"Michael S. Tsirkin" <mst@redhat.com>,
|
||||
Daniel Borkmann <dborkman@redhat.com>
|
||||
To: davem@davemloft.net, edumazet@google.com, netdev@vger.kernel.org,
|
||||
linux-kernel@vger.kernel.org
|
||||
Original-X-From: linux-kernel-owner@vger.kernel.org Fri Nov 01 08:01:39 2013
|
||||
Return-path: <linux-kernel-owner@vger.kernel.org>
|
||||
Envelope-to: glk-linux-kernel-3@plane.gmane.org
|
||||
Original-Received: from vger.kernel.org ([209.132.180.67])
|
||||
by plane.gmane.org with esmtp (Exim 4.69)
|
||||
(envelope-from <linux-kernel-owner@vger.kernel.org>)
|
||||
id 1Vc8jh-00034h-9Y
|
||||
for glk-linux-kernel-3@plane.gmane.org; Fri, 01 Nov 2013 08:01:37 +0100
|
||||
Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
|
||||
id S1753899Ab3KAHB3 (ORCPT <rfc822;glk-linux-kernel-3@m.gmane.org>);
|
||||
Fri, 1 Nov 2013 03:01:29 -0400
|
||||
Original-Received: from mx1.redhat.com ([209.132.183.28]:8081 "EHLO mx1.redhat.com"
|
||||
rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
|
||||
id S1752399Ab3KAHB1 (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
|
||||
Fri, 1 Nov 2013 03:01:27 -0400
|
||||
Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
|
||||
by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rA171QgE005079
|
||||
(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
|
||||
Fri, 1 Nov 2013 03:01:26 -0400
|
||||
Original-Received: from jason-ThinkPad-T430s.nay.redhat.com (dhcp-66-71-71.eng.nay.redhat.com [10.66.71.71] (may be forged))
|
||||
by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id rA171Jpr015790;
|
||||
Fri, 1 Nov 2013 03:01:20 -0400
|
||||
X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12
|
||||
Original-Sender: linux-kernel-owner@vger.kernel.org
|
||||
Precedence: bulk
|
||||
List-ID: <linux-kernel.vger.kernel.org>
|
||||
X-Mailing-List: linux-kernel@vger.kernel.org
|
||||
Xref: news.gmane.org gmane.linux.kernel:1588387 gmane.linux.network:289242
|
||||
Archived-At: <http://permalink.gmane.org/gmane.linux.kernel/1588387>
|
||||
|
||||
We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
|
||||
skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
|
||||
is evil (less than 5).
|
||||
|
||||
This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
|
||||
(rps: support IPIP encapsulation).
|
||||
|
||||
Cc: Eric Dumazet <edumazet@google.com>
|
||||
Cc: Petr Matousek <pmatouse@redhat.com>
|
||||
Cc: Michael S. Tsirkin <mst@redhat.com>
|
||||
Cc: Daniel Borkmann <dborkman@redhat.com>
|
||||
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
||||
---
|
||||
This patch is needed for stable.
|
||||
---
|
||||
net/core/flow_dissector.c | 2 +-
|
||||
1 file changed, 1 insertion(+), 1 deletion(-)
|
||||
|
||||
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
|
||||
index 8d7d0dd..143b6fd 100644
|
||||
--- a/net/core/flow_dissector.c
|
||||
+++ b/net/core/flow_dissector.c
|
||||
@@ -40,7 +40,7 @@ again:
|
||||
struct iphdr _iph;
|
||||
ip:
|
||||
iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
|
||||
- if (!iph)
|
||||
+ if (!iph || iph->ihl < 5)
|
||||
return false;
|
||||
|
||||
if (ip_is_fragment(iph))
|
||||
--
|
||||
1.8.1.2
|
||||
|
||||
Loading…
Reference in New Issue