CVE-2013-4343 net: use-after-free TUNSETIFF (rhbz 1007733 1007741)
This commit is contained in:
parent
a227754a89
commit
b5802b6a1f
|
@ -782,6 +782,9 @@ Patch25099: HID-CVE-fixes.patch
|
|||
#rhbz 1002351
|
||||
Patch25100: crypto-fix-race-in-larval-lookup.patch
|
||||
|
||||
#CVE-2013-4343 rhbz 1007733 1007741
|
||||
Patch25101: tuntap-correctly-handle-error-in-tun_set_iff.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
@ -1499,6 +1502,9 @@ ApplyPatch rt2800-rearrange-bbp-rfcsr-initialization.patch
|
|||
#rhbz1002351
|
||||
ApplyPatch crypto-fix-race-in-larval-lookup.patch
|
||||
|
||||
#CVE-2013-4343 rhbz 1007733 1007741
|
||||
ApplyPatch tuntap-correctly-handle-error-in-tun_set_iff.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
@ -2340,6 +2346,9 @@ fi
|
|||
# ||----w |
|
||||
# || ||
|
||||
%changelog
|
||||
* Fri Sep 13 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- CVE-2013-4343 net: use-after-free TUNSETIFF (rhbz 1007733 1007741)
|
||||
|
||||
* Thu Sep 12 2013 Josh Boyer <jwboyer@fedoraproject.org>
|
||||
- Update HID CVE fixes to fix crash from lenovo-tpkbd driver (rhbz 1003998)
|
||||
|
||||
|
|
|
@ -0,0 +1,57 @@
|
|||
From dff4e504b2addc8053fc47712d44a21f733ef51b Mon Sep 17 00:00:00 2001
|
||||
From: Jason Wang <jasowang@redhat.com>
|
||||
Date: Wed, 11 Sep 2013 18:09:48 +0800
|
||||
Subject: [PATCH] tuntap: correctly handle error in tun_set_iff()
|
||||
|
||||
Commit c8d68e6be1c3b242f1c598595830890b65cea64a
|
||||
(tuntap: multiqueue support) only call free_netdev() on error in
|
||||
tun_set_iff(). This causes several issues:
|
||||
|
||||
- memory of tun security were leaked
|
||||
- use after free since the flow gc timer was not deleted and the tfile
|
||||
were not detached
|
||||
|
||||
This patch solves the above issues.
|
||||
|
||||
Reported-by: Wannes Rombouts <wannes.rombouts@epitech.eu>
|
||||
Cc: Michael S. Tsirkin <mst@redhat.com>
|
||||
Signed-off-by: Jason Wang <jasowang@redhat.com>
|
||||
---
|
||||
drivers/net/tun.c | 11 ++++++++---
|
||||
1 file changed, 8 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
|
||||
index 71af122..68b9aa3 100644
|
||||
--- a/drivers/net/tun.c
|
||||
+++ b/drivers/net/tun.c
|
||||
@@ -1691,11 +1691,11 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
|
||||
INIT_LIST_HEAD(&tun->disabled);
|
||||
err = tun_attach(tun, file);
|
||||
if (err < 0)
|
||||
- goto err_free_dev;
|
||||
+ goto err_free_flow;
|
||||
|
||||
err = register_netdevice(tun->dev);
|
||||
if (err < 0)
|
||||
- goto err_free_dev;
|
||||
+ goto err_detach;
|
||||
|
||||
if (device_create_file(&tun->dev->dev, &dev_attr_tun_flags) ||
|
||||
device_create_file(&tun->dev->dev, &dev_attr_owner) ||
|
||||
@@ -1739,7 +1739,12 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
|
||||
strcpy(ifr->ifr_name, tun->dev->name);
|
||||
return 0;
|
||||
|
||||
- err_free_dev:
|
||||
+err_detach:
|
||||
+ tun_detach_all(dev);
|
||||
+err_free_flow:
|
||||
+ tun_flow_uninit(tun);
|
||||
+ security_tun_dev_free_security(tun->security);
|
||||
+err_free_dev:
|
||||
free_netdev(dev);
|
||||
return err;
|
||||
}
|
||||
--
|
||||
1.8.3.1
|
||||
|
Loading…
Reference in New Issue