linux-kernel - Re: patch 4.8 "net: handle no dst on skb in icmp6

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <5441e604-bd2f-a0d6-a2ba-f376bc8be9c5@spamcop.net>
Date:   Wed, 11 Jan 2017 15:56:19 +0000
From:   Bronek Kozicki <brok@...mcop.net>
To:     Jiri Slaby <jslaby@...e.cz>, stable@...r.kernel.org
Cc:     linux-kernel@...r.kernel.org,
        Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
        David Ahern <dsa@...ulusnetworks.com>
Subject: Re: patch 4.8 "net: handle no dst on skb in icmp6_send"

On 11/01/2017 15:50, Jiri Slaby wrote:
> On 01/08/2017, 03:28 PM, Bronek Kozicki wrote:
>> Hello,
>>
>> any particular reason why this fix
>> https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=79dc7e3f1cd323be4c81aa1a94faa1b3ed987fb2
>> was missed from stable 4.8 line? Apparently the bug being fixed has its
>> own https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-9919
>
> The patch is marked as:
> Fixes: 5d41ce29e ("net: icmp6_send should use dst dev to determine L3
> domain")
>
> and that is only in 4.9. So there seems to be a little point backporting
> to older kernels.


it is water under the bridge now, but I started this thread because I 
noticed that some distributions are adding this to their own 4.8 kernels


B.