From patchwork Mon Jan 31 17:10:05 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: Hardy CVE-2010-3873, memory corruption in X.25 facilities parsing (V2) Date: Mon, 31 Jan 2011 07:10:05 -0000 From: Tim Gardner X-Patchwork-Id: 81184 Message-Id: <4D46ECED.1020601@canonical.com> To: kernel-team@lists.ubuntu.com Return 0 instead of -1 in order to avoid SKB leak. rtg Acked-by: Andy Whitcroft >From 1005daf240df317ad02adda7dd05fbd58930bc1e Mon Sep 17 00:00:00 2001 From: andrew hendry Date: Wed, 3 Nov 2010 12:54:53 +0000 Subject: [PATCH] memory corruption in X.25 facilities parsing, CVE-2010-3873 BugLink: http://bugs.launchpad.net/bugs/709372 CVE-2010-3873 Backported from a6331d6f9a4298173b413cf99a40cc86a9d92c37 by Tim Gardner Signed-of-by: Andrew Hendry Signed-off-by: David S. Miller Signed-off-by: Tim Gardner --- net/x25/x25_facilities.c | 8 ++++---- net/x25/x25_in.c | 11 +++++++---- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c index dec404a..fa5eb98 100644 --- a/net/x25/x25_facilities.c +++ b/net/x25/x25_facilities.c @@ -126,15 +126,15 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities, case X25_FAC_CLASS_D: switch (*p) { case X25_FAC_CALLING_AE: - if (p[1] > X25_MAX_DTE_FACIL_LEN) - break; + if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1) + return 0; dte_facs->calling_len = p[2]; memcpy(dte_facs->calling_ae, &p[3], p[1] - 1); *vc_fac_mask |= X25_MASK_CALLING_AE; break; case X25_FAC_CALLED_AE: - if (p[1] > X25_MAX_DTE_FACIL_LEN) - break; + if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1) + return 0; dte_facs->called_len = p[2]; memcpy(dte_facs->called_ae, &p[3], p[1] - 1); *vc_fac_mask |= X25_MASK_CALLED_AE; diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c index 1c88762..5677d0e 100644 --- a/net/x25/x25_in.c +++ b/net/x25/x25_in.c @@ -93,6 +93,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp switch (frametype) { case X25_CALL_ACCEPTED: { struct x25_sock *x25 = x25_sk(sk); + int len; x25_stop_timer(sk); x25->condition = 0x00; @@ -107,10 +108,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp */ skb_pull(skb, X25_STD_MIN_LEN); skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr)); - skb_pull(skb, - x25_parse_facilities(skb, &x25->facilities, - &x25->dte_facilities, - &x25->vc_facil_mask)); + len = x25_parse_facilities(skb, &x25->facilities, + &x25->dte_facilities, &x25->vc_facil_mask); + if (len <= 0) + return 0; + skb_pull(skb, len); + /* * Copy any Call User Data. */ -- 1.7.0.4