Message ID | 20171208143950.23731-2-kleber.souza@canonical.com |
---|---|
State | New |
Headers | show |
Series | [SRU,T/X/Z/A,1/1] dccp: CVE-2017-8824: use-after-free in DCCP code | expand |
On Fri, Dec 08, 2017 at 03:39:50PM +0100, Kleber Sacilotto de Souza wrote: > From: Mohamed Ghannam <simo.ghannam@gmail.com> > > Whenever the sock object is in DCCP_CLOSED state, > dccp_disconnect() must free dccps_hc_tx_ccid and > dccps_hc_rx_ccid and set to NULL. > > Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com> > Reviewed-by: Eric Dumazet <edumazet@google.com> > Signed-off-by: David S. Miller <davem@davemloft.net> > > CVE-2017-8824 > (cherry picked from commit 69c64866ce072dea1d1e59a0d61e0f66c0dffb76 linux-next) > Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com> Acked-by: Seth Forshee <seth.forshee@canonical.com> Applied to bionic and unstable.
Applied to trusty, xenial, zesty and artful master-next branches. Thanks. Cascardo. Applied-to: trusty/master-next Applied-to: xenial/master-next Applied-to: zesty/master-next Applied-to: artful/master-next
diff --git a/net/dccp/proto.c b/net/dccp/proto.c index b68168f..9d43c1f 100644 --- a/net/dccp/proto.c +++ b/net/dccp/proto.c @@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags) { struct inet_connection_sock *icsk = inet_csk(sk); struct inet_sock *inet = inet_sk(sk); + struct dccp_sock *dp = dccp_sk(sk); int err = 0; const int old_state = sk->sk_state; @@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags) sk->sk_err = ECONNRESET; dccp_clear_xmit_timers(sk); + ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); + ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); + dp->dccps_hc_rx_ccid = NULL; + dp->dccps_hc_tx_ccid = NULL; __skb_queue_purge(&sk->sk_receive_queue); __skb_queue_purge(&sk->sk_write_queue);