1 From: Chris Wright <chrisw@sous-sol.org>
2 Date: Wed, 4 Jun 2008 16:16:33 +0000 (-0700)
3 Subject: asn1: additional sanity checking during BER decoding (CVE-2008-1673)
5 X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.25.y.git;a=commitdiff_plain;h=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c
7 asn1: additional sanity checking during BER decoding (CVE-2008-1673)
9 upstream commit: ddb2c43594f22843e9f3153da151deaba1a834c5
11 - Don't trust a length which is greater than the working buffer.
12 An invalid length could cause overflow when calculating buffer size
15 - An oid length of zero is invalid and allows for an off-by-one error when
16 decoding oid because the first subid actually encodes first 2 subids.
18 - A primitive encoding may not have an indefinite length.
20 Thanks to Wei Wang from McAfee for report.
22 Cc: Steven French <sfrench@us.ibm.com>
24 Acked-by: Patrick McHardy <kaber@trash.net>
25 Signed-off-by: Chris Wright <chrisw@sous-sol.org>
26 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
28 rediff for Linux-2.6.20.21 by Arne Fitzenreiter <arne_f@ipfire.org>
30 From: Chris Wright <chrisw@sous-sol.org>
31 Date: Wed, 4 Jun 2008 16:16:33 +0000 (-0700)
32 Subject: asn1: additional sanity checking during BER decoding (CVE-2008-1673)
33 X-Git-Tag: v2.6.25.5~1
34 X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.25.y.git;a=commitdiff_plain;h=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c
36 asn1: additional sanity checking during BER decoding (CVE-2008-1673)
38 upstream commit: ddb2c43594f22843e9f3153da151deaba1a834c5
40 - Don't trust a length which is greater than the working buffer.
41 An invalid length could cause overflow when calculating buffer size
44 - An oid length of zero is invalid and allows for an off-by-one error when
45 decoding oid because the first subid actually encodes first 2 subids.
47 - A primitive encoding may not have an indefinite length.
49 Thanks to Wei Wang from McAfee for report.
51 Cc: Steven French <sfrench@us.ibm.com>
53 Acked-by: Patrick McHardy <kaber@trash.net>
54 Signed-off-by: Chris Wright <chrisw@sous-sol.org>
55 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
57 rediff for Linux-2.6.20.21 by Arne Fitzenreiter <arne_f@ipfire.org>
59 diff -Naur linux-2.6.20.21.org/fs/cifs/asn1.c linux-2.6.20.21/fs/cifs/asn1.c
60 --- linux-2.6.20.21.org/fs/cifs/asn1.c 2007-10-17 21:31:14.000000000 +0200
61 +++ linux-2.6.20.21/fs/cifs/asn1.c 2008-06-10 00:09:43.000000000 +0200
67 + /* don't trust len bigger than ctx buffer */
68 + if (*len > ctx->end - ctx->pointer)
75 if (!asn1_length_decode(ctx, &def, &len))
78 + /* primitive shall be definite, indefinite shall be constructed */
79 + if (*con == ASN1_PRI && !def)
83 *eoc = ctx->pointer + len;
88 size = eoc - ctx->pointer + 1;
90 + /* first subid actually encodes first two subids */
91 + if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
93 *oid = kmalloc(size * sizeof (unsigned long), GFP_ATOMIC);
96 diff -Naur linux-2.6.20.21.org/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.20.21/net/ipv4/netfilter/nf_nat_snmp_basic.c
97 --- linux-2.6.20.21.org/net/ipv4/netfilter/nf_nat_snmp_basic.c 2007-10-17 21:31:14.000000000 +0200
98 +++ linux-2.6.20.21/net/ipv4/netfilter/nf_nat_snmp_basic.c 2008-06-10 00:03:59.000000000 +0200
104 + /* don't trust len bigger than ctx buffer */
105 + if (*len > ctx->end - ctx->pointer)
112 if (!asn1_length_decode(ctx, &def, &len))
115 + /* primitive shall be definite, indefinite shall be constructed */
116 + if (*con == ASN1_PRI && !def)
120 *eoc = ctx->pointer + len;
125 size = eoc - ctx->pointer + 1;
127 + /* first subid actually encodes first two subids */
128 + if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
131 *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);