From 46e917efbc994d5efdfcf6fc3628644cd1701d49 Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Tue, 26 Feb 2013 14:41:06 -0800 Subject: [PATCH] 3.7-stable patches added patches: sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch --- queue-3.7/series | 1 + ...-bounds-access-to-sock_diag_handlers.patch | 35 +++++++++++++++++++ 2 files changed, 36 insertions(+) create mode 100644 queue-3.7/sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch diff --git a/queue-3.7/series b/queue-3.7/series index fd5d1500159..d4135ffb8b4 100644 --- a/queue-3.7/series +++ b/queue-3.7/series @@ -58,3 +58,4 @@ sparc64-fix-tsb_grow-in-atomic-context.patch sparc64-fix-huge-pmd-to-pte-translation-for-sun4u-in-tlb-miss-handler.patch drm-i915-fix-up-mismerge-of-3490ea5d-in-3.7.y.patch target-fix-divide-by-zero-bug-in-fabric_max_sectors-for-unconfigured-devices.patch +sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch diff --git a/queue-3.7/sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch b/queue-3.7/sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch new file mode 100644 index 00000000000..5da59c17f13 --- /dev/null +++ b/queue-3.7/sock_diag-fix-out-of-bounds-access-to-sock_diag_handlers.patch @@ -0,0 +1,35 @@ +From 9e8a3fc107d3b765276aa2f826e22933f38bb000 Mon Sep 17 00:00:00 2001 +From: Mathias Krause +Date: Sat, 23 Feb 2013 01:13:47 +0000 +Subject: sock_diag: Fix out-of-bounds access to sock_diag_handlers[] + +From: Mathias Krause + +[ Upstream commit 6e601a53566d84e1ffd25e7b6fe0b6894ffd79c0 ] + +Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY +with a family greater or equal then AF_MAX -- the array size of +sock_diag_handlers[]. The current code does not test for this +condition therefore is vulnerable to an out-of-bound access opening +doors for a privilege escalation. + +Signed-off-by: Mathias Krause +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Greg Kroah-Hartman +--- + net/core/sock_diag.c | 3 +++ + 1 file changed, 3 insertions(+) + +--- a/net/core/sock_diag.c ++++ b/net/core/sock_diag.c +@@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk + if (nlmsg_len(nlh) < sizeof(*req)) + return -EINVAL; + ++ if (req->sdiag_family >= AF_MAX) ++ return -EINVAL; ++ + hndl = sock_diag_lock_handler(req->sdiag_family); + if (hndl == NULL) + err = -ENOENT; -- 2.47.3