| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Wed, 18 Jul 2012 09:02:06 -0700 (PDT) From: David Miller <davem@...emloft.net> To: pmoore@...hat.com Cc: netdev@...r.kernel.org Subject: Re: [PATCH] cipso: don't follow a NULL pointer when setsockopt() is called From: Paul Moore <pmoore@...hat.com> Date: Tue, 17 Jul 2012 17:07:47 -0400 > As reported by Alan Cox, and verified by Lin Ming, when a user > attempts to add a CIPSO option to a socket using the CIPSO_V4_TAG_LOCAL > tag the kernel dies a terrible death when it attempts to follow a NULL > pointer (the skb argument to cipso_v4_validate() is NULL when called via > the setsockopt() syscall). > > This patch fixes this by first checking to ensure that the skb is > non-NULL before using it to find the incoming network interface. In > the unlikely case where the skb is NULL and the user attempts to add > a CIPSO option with the _TAG_LOCAL tag we return an error as this is > not something we want to allow. > > A simple reproducer, kindly supplied by Lin Ming, although you must > have the CIPSO DOI #3 configure on the system first or you will be > caught early in cipso_v4_validate(): ... > CC: Lin Ming <mlin@...pku.edu.cn> > Reported-by: Alan Cox <alan@...rguk.ukuu.org.uk> > Signed-off-by: Paul Moore <pmoore@...hat.com> Applied and queued up for -stable, thanks Paul. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@...r.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
Powered by blists - more mailing lists