From patchwork Tue Mar 8 15:46:05 2011 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steve Conklin X-Patchwork-Id: 86022 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from chlorine.canonical.com (chlorine.canonical.com [91.189.94.204]) by ozlabs.org (Postfix) with ESMTP id E3B18B70B0 for ; Wed, 9 Mar 2011 02:47:24 +1100 (EST) Received: from localhost ([127.0.0.1] helo=chlorine.canonical.com) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Pwz85-0002a6-3V; Tue, 08 Mar 2011 15:47:21 +0000 Received: from adelie.canonical.com ([91.189.90.139]) by chlorine.canonical.com with esmtp (Exim 4.71) (envelope-from ) id 1Pwz82-0002ZE-Dz for kernel-team@lists.ubuntu.com; Tue, 08 Mar 2011 15:47:18 +0000 Received: from youngberry.canonical.com ([91.189.89.112]) by adelie.canonical.com with esmtp (Exim 4.71 #1 (Debian)) id 1Pwz82-0001Kg-BP for ; Tue, 08 Mar 2011 15:47:18 +0000 Received: from [91.189.88.12] (helo=canonical.com) by youngberry.canonical.com with esmtpsa (TLS1.0:DHE_RSA_AES_128_CBC_SHA1:16) (Exim 4.71) (envelope-from ) id 1Pwz82-0001Nz-9w for kernel-team@lists.ubuntu.com; Tue, 08 Mar 2011 15:47:18 +0000 From: Steve Conklin To: kernel-team@lists.ubuntu.com Subject: [PATCH DAPPER] x25: Prevent crashing when parsing bad X.25 facilities CVE-2010-4164 Date: Tue, 8 Mar 2011 15:46:05 +0000 Message-Id: <1299599165-10049-1-git-send-email-sconklin@canonical.com> X-Mailer: git-send-email 1.7.0.4 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.13 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , MIME-Version: 1.0 Sender: kernel-team-bounces@lists.ubuntu.com Errors-To: kernel-team-bounces@lists.ubuntu.com BugLink: http://bugs.launchpad.net/bugs/731199 CVE-2010-4164 Now with improved comma support. On parsing malformed X.25 facilities, decrementing the remaining length may cause it to underflow. Since the length is an unsigned integer, this will result in the loop continuing until the kernel crashes. This patch adds checks to ensure decrementing the remaining length does not cause it to wrap around. Signed-off-by: Dan Rosenberg Signed-off-by: David S. Miller (based on upstream commit 5ef41308f94dcbb3b7afc56cdef1c2ba53fa5d2f) Signed-off-by: Steve Conklin --- net/x25/x25_facilities.c | 8 ++++++++ 1 files changed, 8 insertions(+), 0 deletions(-) diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c index 54278b9..2af5e45 100644 --- a/net/x25/x25_facilities.c +++ b/net/x25/x25_facilities.c @@ -43,6 +43,8 @@ int x25_parse_facilities(struct sk_buff *skb, while (len > 0) { switch (*p & X25_FAC_CLASS_MASK) { case X25_FAC_CLASS_A: + if (len < 2) + return 0; switch (*p) { case X25_FAC_REVERSE: if((p[1] & 0x81) == 0x81) { @@ -84,6 +86,8 @@ int x25_parse_facilities(struct sk_buff *skb, len -= 2; break; case X25_FAC_CLASS_B: + if (len < 3) + return 0; switch (*p) { case X25_FAC_PACKET_SIZE: facilities->pacsize_in = p[1]; @@ -105,6 +109,8 @@ int x25_parse_facilities(struct sk_buff *skb, len -= 3; break; case X25_FAC_CLASS_C: + if (len < 4) + return 0; printk(KERN_DEBUG "X.25: unknown facility %02X, " "values %02X, %02X, %02X\n", p[0], p[1], p[2], p[3]); @@ -112,6 +118,8 @@ int x25_parse_facilities(struct sk_buff *skb, len -= 4; break; case X25_FAC_CLASS_D: + if (len < p[1] + 2) + return 0; printk(KERN_DEBUG "X.25: unknown facility %02X, " "length %d, values %02X, %02X, %02X, %02X\n", p[0], p[1], p[2], p[3], p[4], p[5]);