From: Chris Wright Date: Wed, 31 May 2006 00:18:39 +0000 (-0700) Subject: netfilter SO_ORIGINAL_DST fix (CVE-2006-1343) X-Git-Tag: v2.6.16.19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=fe050e37bd43837fcd78856680c7474d13272fcd;p=thirdparty%2Fkernel%2Fstable-queue.git netfilter SO_ORIGINAL_DST fix (CVE-2006-1343) --- diff --git a/releases/2.6.16.19/netfilter-fix-small-information-leak-in-so_original_dst.patch b/releases/2.6.16.19/netfilter-fix-small-information-leak-in-so_original_dst.patch new file mode 100644 index 00000000000..2b70a016a5c --- /dev/null +++ b/releases/2.6.16.19/netfilter-fix-small-information-leak-in-so_original_dst.patch @@ -0,0 +1,39 @@ +From stable-bounces@linux.kernel.org Fri May 26 04:54:47 2006 +Date: Fri, 26 May 2006 13:50:46 +0200 +From: Marcel Holtmann +To: netdev@vger.kernel.org +Cc: stable@kernel.org +Subject: NETFILTER: Fix small information leak in SO_ORIGINAL_DST (CVE-2006-1343) + +It appears that sockaddr_in.sin_zero is not zeroed during +getsockopt(...SO_ORIGINAL_DST...) operation. This can lead +to an information leak (CVE-2006-1343). + +Signed-off-by: Marcel Holtmann +Signed-off-by: Chris Wright +--- + + net/ipv4/netfilter/ip_conntrack_core.c | 1 + + net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c | 1 + + 2 files changed, 2 insertions(+) + +--- linux-2.6.16.18.orig/net/ipv4/netfilter/ip_conntrack_core.c ++++ linux-2.6.16.18/net/ipv4/netfilter/ip_conntrack_core.c +@@ -1318,6 +1318,7 @@ getorigdst(struct sock *sk, int optval, + .tuple.dst.u.tcp.port; + sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL] + .tuple.dst.ip; ++ memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); + + DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n", + NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port)); +--- linux-2.6.16.18.orig/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c ++++ linux-2.6.16.18/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c +@@ -354,6 +354,7 @@ getorigdst(struct sock *sk, int optval, + .tuple.dst.u.tcp.port; + sin.sin_addr.s_addr = ct->tuplehash[IP_CT_DIR_ORIGINAL] + .tuple.dst.u3.ip; ++ memset(sin.sin_zero, 0, sizeof(sin.sin_zero)); + + DEBUGP("SO_ORIGINAL_DST: %u.%u.%u.%u %u\n", + NIPQUAD(sin.sin_addr.s_addr), ntohs(sin.sin_port)); diff --git a/releases/2.6.16.19/series b/releases/2.6.16.19/series new file mode 100644 index 00000000000..6aae90b2f21 --- /dev/null +++ b/releases/2.6.16.19/series @@ -0,0 +1 @@ +netfilter-fix-small-information-leak-in-so_original_dst.patch