Message ID | 20110128203931.4CF53F89F8@sepang.rtg.net |
---|---|
State | Accepted |
Delegated to: | Stefan Bader |
Headers | show |
On 01/28/2011 09:39 PM, Tim Gardner wrote: > The following changes since commit b82d20049acc781ff45855a394fc9d693e4b09d2: > Linus Torvalds (1): > net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859 > > are available in the git repository at: > > git://kernel.ubuntu.com/rtg/ubuntu-karmic.git CVE-2010-3873 > > andrew hendry (1): > memory corruption in X.25 facilities parsing, CVE-2010-3873 > > net/x25/x25_facilities.c | 8 ++++---- > net/x25/x25_in.c | 11 +++++++---- > 2 files changed, 11 insertions(+), 8 deletions(-) > > From 73767f1aabbc108e418eda23917efd6e0ec7ff68 Mon Sep 17 00:00:00 2001 > From: andrew hendry <andrew.hendry@gmail.com> > Date: Wed, 3 Nov 2010 12:54:53 +0000 > Subject: [PATCH] memory corruption in X.25 facilities parsing, CVE-2010-3873 > > BugLink: http://bugs.launchpad.net/bugs/709372 > > CVE-2010-3873 > > Backported from a6331d6f9a4298173b413cf99a40cc86a9d92c37 > by Tim Gardner <tim.gardner@canonical.com> > > Signed-of-by: Andrew Hendry <andrew.hendry@gmail.com> > > Signed-off-by: David S. Miller <davem@davemloft.net> > Signed-off-by: Tim Gardner <tim.gardner@canonical.com> Acked-by: Stefan Bader <stefan.bader@canonical.com> > --- > net/x25/x25_facilities.c | 8 ++++---- > net/x25/x25_in.c | 11 +++++++---- > 2 files changed, 11 insertions(+), 8 deletions(-) > > diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c > index a21f664..e233de3 100644 > --- a/net/x25/x25_facilities.c > +++ b/net/x25/x25_facilities.c > @@ -126,15 +126,15 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities, > case X25_FAC_CLASS_D: > switch (*p) { > case X25_FAC_CALLING_AE: > - if (p[1] > X25_MAX_DTE_FACIL_LEN) > - break; > + if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1) > + return 0; > dte_facs->calling_len = p[2]; > memcpy(dte_facs->calling_ae, &p[3], p[1] - 1); > *vc_fac_mask |= X25_MASK_CALLING_AE; > break; > case X25_FAC_CALLED_AE: > - if (p[1] > X25_MAX_DTE_FACIL_LEN) > - break; > + if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1) > + return 0; > dte_facs->called_len = p[2]; > memcpy(dte_facs->called_ae, &p[3], p[1] - 1); > *vc_fac_mask |= X25_MASK_CALLED_AE; > diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c > index 7d7c3ab..b68dbac 100644 > --- a/net/x25/x25_in.c > +++ b/net/x25/x25_in.c > @@ -93,6 +93,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp > switch (frametype) { > case X25_CALL_ACCEPTED: { > struct x25_sock *x25 = x25_sk(sk); > + int len; > > x25_stop_timer(sk); > x25->condition = 0x00; > @@ -107,10 +108,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp > */ > skb_pull(skb, X25_STD_MIN_LEN); > skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr)); > - skb_pull(skb, > - x25_parse_facilities(skb, &x25->facilities, > - &x25->dte_facilities, > - &x25->vc_facil_mask)); > + len = x25_parse_facilities(skb, &x25->facilities, > + &x25->dte_facilities, &x25->vc_facil_mask); > + if (len <= 0) > + return -1; > + skb_pull(skb, len); > + > /* > * Copy any Call User Data. > */
applied and pushed