From patchwork Mon Feb 25 17:45:41 2013 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Brad Figg X-Patchwork-Id: 222981 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id 705E42C0091 for ; Tue, 26 Feb 2013 04:45:57 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1UA27V-00053c-Nj; Mon, 25 Feb 2013 17:45:45 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1UA27T-00053M-Jh for kernel-team@lists.ubuntu.com; Mon, 25 Feb 2013 17:45:43 +0000 Received: from static-50-53-107-235.bvtn.or.frontiernet.net ([50.53.107.235] helo=localhost) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1UA27T-0003VD-8w for kernel-team@lists.ubuntu.com; Mon, 25 Feb 2013 17:45:43 +0000 From: Brad Figg To: kernel-team@lists.ubuntu.com Subject: [Quantal/Raring] [PATCH 1/1] [CVE-2013-1763] sock_diag: Fix out-of-bounds access to sock_diag_handlers[] Date: Mon, 25 Feb 2013 09:45:41 -0800 Message-Id: <1361814341-13102-1-git-send-email-brad.figg@canonical.com> X-Mailer: git-send-email 1.7.9.5 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com From: Mathias Krause CVE-2013-1763 BugLink: http://bugs.launchpad.net/bugs/1132896 Signed-off-by: Mathias Krause Signed-off-by: Brad Figg Signed-off-by: Steve Conklin Signed-off-by: John Johansen --- net/core/sock_diag.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c index 5fd1467..964a92c 100644 --- a/net/core/sock_diag.c +++ b/net/core/sock_diag.c @@ -126,6 +126,9 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) if (nlmsg_len(nlh) < sizeof(*req)) return -EINVAL; + if (req->sdiag_family >= AF_MAX) + return -EINVAL; + hndl = sock_diag_lock_handler(req->sdiag_family); if (hndl == NULL) err = -ENOENT;