CVE-2013-3231 llc: Fix missing msg_namelen update in llc_ui_recvmsg (rhbz 956094 956104)
This commit is contained in:
parent
82eda85f49
commit
c416a99578
|
@ -826,6 +826,9 @@ Patch25021: NFC-llcp-fix-info-leaks-via-msg_name-in-llcp_sock_re.patch
|
|||
#CVE-2013-3232 956110 956113
|
||||
Patch25022: netrom-fix-invalid-use-of-sizeof-in-nr_recvmsg.patch
|
||||
|
||||
#CVE-2013-3231 956094 956104
|
||||
Patch25023: llc-Fix-missing-msg_namelen-update-in-llc_ui_recvmsg.patch
|
||||
|
||||
# END OF PATCH DEFINITIONS
|
||||
|
||||
%endif
|
||||
|
@ -1602,6 +1605,9 @@ ApplyPatch NFC-llcp-fix-info-leaks-via-msg_name-in-llcp_sock_re.patch
|
|||
#CVE-2013-3232 956110 956113
|
||||
ApplyPatch netrom-fix-invalid-use-of-sizeof-in-nr_recvmsg.patch
|
||||
|
||||
#CVE-2013-3231 956094 956104
|
||||
ApplyPatch llc-Fix-missing-msg_namelen-update-in-llc_ui_recvmsg.patch
|
||||
|
||||
# END OF PATCH APPLICATIONS
|
||||
|
||||
%endif
|
||||
|
@ -2460,6 +2466,7 @@ fi
|
|||
# || ||
|
||||
%changelog
|
||||
* Wed Apr 24 2013 Josh Boyer <jwboyer@redhat.com>
|
||||
- CVE-2013-3231 llc: Fix missing msg_namelen update in llc_ui_recvmsg (rhbz 956094 956104)
|
||||
- CVE-2013-3232 netrom: information leak via msg_name in nr_recvmsg (rhbz 956110 956113)
|
||||
- CVE-2013-3233 NFC: llcp: info leaks via msg_name in llcp_sock_recvmsg (rhbz 956125 956129)
|
||||
- CVE-2013-3234 rose: info leak via msg_name in rose_recvmsg (rhbz 956135 956139)
|
||||
|
|
|
@ -0,0 +1,37 @@
|
|||
From c77a4b9cffb6215a15196ec499490d116dfad181 Mon Sep 17 00:00:00 2001
|
||||
From: Mathias Krause <minipli@googlemail.com>
|
||||
Date: Sun, 7 Apr 2013 01:51:56 +0000
|
||||
Subject: [PATCH] llc: Fix missing msg_namelen update in llc_ui_recvmsg()
|
||||
|
||||
For stream sockets the code misses to update the msg_namelen member
|
||||
to 0 and therefore makes net/socket.c leak the local, uninitialized
|
||||
sockaddr_storage variable to userland -- 128 bytes of kernel stack
|
||||
memory. The msg_namelen update is also missing for datagram sockets
|
||||
in case the socket is shutting down during receive.
|
||||
|
||||
Fix both issues by setting msg_namelen to 0 early. It will be
|
||||
updated later if we're going to fill the msg_name member.
|
||||
|
||||
Cc: Arnaldo Carvalho de Melo <acme@ghostprotocols.net>
|
||||
Signed-off-by: Mathias Krause <minipli@googlemail.com>
|
||||
Signed-off-by: David S. Miller <davem@davemloft.net>
|
||||
---
|
||||
net/llc/af_llc.c | 2 ++
|
||||
1 file changed, 2 insertions(+)
|
||||
|
||||
diff --git a/net/llc/af_llc.c b/net/llc/af_llc.c
|
||||
index 8870988..48aaa89 100644
|
||||
--- a/net/llc/af_llc.c
|
||||
+++ b/net/llc/af_llc.c
|
||||
@@ -720,6 +720,8 @@ static int llc_ui_recvmsg(struct kiocb *iocb, struct socket *sock,
|
||||
int target; /* Read at least this many bytes */
|
||||
long timeo;
|
||||
|
||||
+ msg->msg_namelen = 0;
|
||||
+
|
||||
lock_sock(sk);
|
||||
copied = -ENOTCONN;
|
||||
if (unlikely(sk->sk_type == SOCK_STREAM && sk->sk_state == TCP_LISTEN))
|
||||
--
|
||||
1.8.1.4
|
||||
|
Loading…
Reference in New Issue