From: Arne Fitzenreiter Date: Mon, 9 Jun 2008 22:57:31 +0000 (+0200) Subject: Applied "check on BER decoding" security fix X-Git-Tag: v2.3-beta1~48^2~10 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=aaf383626976ceb573ce59da2667f156b77a3ada;p=ipfire-2.x.git Applied "check on BER decoding" security fix --- diff --git a/lfs/linux b/lfs/linux index 00e39e5df3..3cefea1358 100644 --- a/lfs/linux +++ b/lfs/linux @@ -103,6 +103,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects)) @rm -rf $(DIR_APP) $(DIR_SRC)/linux $(DIR_SRC)/xen-* && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE) ln -s linux-$(VER) /usr/src/linux + # Security fix for CIFS & Netfilter SNMP + cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.20.21-additional_check_on_BER_decoding.patch + # Openswan 2 cd $(DIR_SRC) && rm -rf openswan-* cd $(DIR_SRC) && tar xfz $(DIR_DL)/openswan-2.4.12.tar.gz diff --git a/src/patches/linux-2.6.20.21-additional_check_on_BER_decoding.patch b/src/patches/linux-2.6.20.21-additional_check_on_BER_decoding.patch new file mode 100644 index 0000000000..c667af9e30 --- /dev/null +++ b/src/patches/linux-2.6.20.21-additional_check_on_BER_decoding.patch @@ -0,0 +1,133 @@ +From: Chris Wright +Date: Wed, 4 Jun 2008 16:16:33 +0000 (-0700) +Subject: asn1: additional sanity checking during BER decoding (CVE-2008-1673) +X-Git-Tag: v2.6.25.5~1 +X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.25.y.git;a=commitdiff_plain;h=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c + +asn1: additional sanity checking during BER decoding (CVE-2008-1673) + +upstream commit: ddb2c43594f22843e9f3153da151deaba1a834c5 + +- Don't trust a length which is greater than the working buffer. + An invalid length could cause overflow when calculating buffer size + for decoding oid. + +- An oid length of zero is invalid and allows for an off-by-one error when + decoding oid because the first subid actually encodes first 2 subids. + +- A primitive encoding may not have an indefinite length. + +Thanks to Wei Wang from McAfee for report. + +Cc: Steven French +Cc: stable@kernel.org +Acked-by: Patrick McHardy +Signed-off-by: Chris Wright +Signed-off-by: Linus Torvalds +--- +rediff for Linux-2.6.20.21 by Arne Fitzenreiter +--- +From: Chris Wright +Date: Wed, 4 Jun 2008 16:16:33 +0000 (-0700) +Subject: asn1: additional sanity checking during BER decoding (CVE-2008-1673) +X-Git-Tag: v2.6.25.5~1 +X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.25.y.git;a=commitdiff_plain;h=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c + +asn1: additional sanity checking during BER decoding (CVE-2008-1673) + +upstream commit: ddb2c43594f22843e9f3153da151deaba1a834c5 + +- Don't trust a length which is greater than the working buffer. + An invalid length could cause overflow when calculating buffer size + for decoding oid. + +- An oid length of zero is invalid and allows for an off-by-one error when + decoding oid because the first subid actually encodes first 2 subids. + +- A primitive encoding may not have an indefinite length. + +Thanks to Wei Wang from McAfee for report. + +Cc: Steven French +Cc: stable@kernel.org +Acked-by: Patrick McHardy +Signed-off-by: Chris Wright +Signed-off-by: Linus Torvalds +--- +rediff for Linux-2.6.20.21 by Arne Fitzenreiter +--- +diff -Naur linux-2.6.20.21.org/fs/cifs/asn1.c linux-2.6.20.21/fs/cifs/asn1.c +--- linux-2.6.20.21.org/fs/cifs/asn1.c 2007-10-17 21:31:14.000000000 +0200 ++++ linux-2.6.20.21/fs/cifs/asn1.c 2008-06-10 00:09:43.000000000 +0200 +@@ -182,6 +182,11 @@ + } + } + } ++ ++ /* don't trust len bigger than ctx buffer */ ++ if (*len > ctx->end - ctx->pointer) ++ return 0; ++ + return 1; + } + +@@ -199,6 +204,10 @@ + if (!asn1_length_decode(ctx, &def, &len)) + return 0; + ++ /* primitive shall be definite, indefinite shall be constructed */ ++ if (*con == ASN1_PRI && !def) ++ return 0; ++ + if (def) + *eoc = ctx->pointer + len; + else +@@ -385,6 +394,10 @@ + unsigned long *optr; + + size = eoc - ctx->pointer + 1; ++ ++ /* first subid actually encodes first two subids */ ++ if (size < 2 || size > ULONG_MAX/sizeof(unsigned long)) ++ return 0; + *oid = kmalloc(size * sizeof (unsigned long), GFP_ATOMIC); + if (*oid == NULL) { + return 0; +diff -Naur linux-2.6.20.21.org/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.20.21/net/ipv4/netfilter/nf_nat_snmp_basic.c +--- linux-2.6.20.21.org/net/ipv4/netfilter/nf_nat_snmp_basic.c 2007-10-17 21:31:14.000000000 +0200 ++++ linux-2.6.20.21/net/ipv4/netfilter/nf_nat_snmp_basic.c 2008-06-10 00:03:59.000000000 +0200 +@@ -235,6 +235,11 @@ + } + } + } ++ ++ /* don't trust len bigger than ctx buffer */ ++ if (*len > ctx->end - ctx->pointer) ++ return 0; ++ + return 1; + } + +@@ -253,6 +258,10 @@ + if (!asn1_length_decode(ctx, &def, &len)) + return 0; + ++ /* primitive shall be definite, indefinite shall be constructed */ ++ if (*con == ASN1_PRI && !def) ++ return 0; ++ + if (def) + *eoc = ctx->pointer + len; + else +@@ -437,6 +446,11 @@ + unsigned long *optr; + + size = eoc - ctx->pointer + 1; ++ ++ /* first subid actually encodes first two subids */ ++ if (size < 2 || size > ULONG_MAX/sizeof(unsigned long)) ++ return 0; ++ + *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC); + if (*oid == NULL) { + if (net_ratelimit())