netdev - Re: [RFC PATCH tcp-2.6 1/2] [TCP]: Discard fuzzy SACK blocks

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20070618.231646.71856685.davem@davemloft.net>
Date:	Mon, 18 Jun 2007 23:16:46 -0700 (PDT)
From:	David Miller <davem@...emloft.net>
To:	ilpo.jarvinen@...sinki.fi
Cc:	netdev@...r.kernel.org
Subject: Re: [RFC PATCH tcp-2.6 1/2] [TCP]: Discard fuzzy SACK blocks

From: "Ilpo_Järvinen" <ilpo.jarvinen@...sinki.fi>
Date: Tue, 19 Jun 2007 01:25:57 +0300

> From: =?ISO-8859-1?q?Ilpo_J=E4rvinen?= <ilpo.jarvinen@...sinki.fi>
> 
> SACK processing code has been sort of russian roulette as no
> validation of SACK blocks is previously attempted. It is not
> very clear what all kinds of broken SACK blocks really mean
> (e.g., one that has start and end sequence numbers reversed).
> 
> This fixes also one remote triggerable NULL-ptr access:
> start_seq was trusted as a valid mark_lost_entry_seq but
> without validation it is relatively easy to inject an invalid
> sequence number there that will cause a crash in the lost
> marker code. Other SACK processing code seems safe so this could
> have been fixed locally but that would leave SACK processing
> hazardous in case of future modifications. IMHO, it's just
> better to close the whole roulette rather than disarming just
> one bullet.
> 
> Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@...sinki.fi>

This looks good applied.

Does mainline 2.6.x has this NULL-ptr issues too?  If so
we'll have to fix it there very soon.
-
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html