netdev - Re: [PATCH 3.13.y] nfqueue: Orphan frags in nfqnl

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1396223802.1241.33.camel@deadeye.wl.decadent.org.uk>
Date:	Mon, 31 Mar 2014 00:56:42 +0100
From:	Ben Hutchings <ben@...adent.org.uk>
To:	Josh Boyer <jwboyer@...oraproject.org>
Cc:	"David S. Miller" <davem@...emloft.net>,
	Zoltan Kiss <zoltan.kiss@...rix.com>,
	Thomas Graf <tgraf@...g.ch>, netdev@...r.kernel.org
Subject: Re: [PATCH 3.13.y] nfqueue: Orphan frags in nfqnl_zcopy and handle
 errors

On Fri, 2014-03-28 at 10:29 -0400, Josh Boyer wrote:
> Backport of upstream commit 36d5fe6a0007 to 3.13.y
> 
> nfqnl_zcopy can copy elements of the frags array between skbs, but it doesn't
> orphan them.  Also, it doesn't handle errors, so this patch takes care of that
> as well, and modify the caller accordingly.  skb_tx_error() is also added to
> the callers so they will signal the failed delivery towards the creator of the
> skb.
> 
> Fixes CVE-2014-2568.
> 
> Signed-off-by: Zoltan Kiss <zoltan.kiss@...rix.com>
> Signed-off-by: David S. Miller <davem@...emloft.net>
> Signed-off-by: Josh Boyer <jwboyer@...oraproject.org>
[...]

FWIW, I applied the same change to Debian's 3.13.7-1, except for leaving
'from' as pointer-to-const.

Ben.

-- 
Ben Hutchings
friends: People who know you well, but like you anyway.

Download attachment "signature.asc" of type "application/pgp-signature" (812 bytes)