src/patches/linux/linux-4.14_cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch

   1 From: Arne Fitzenreiter <arne.fitzenreiter@ipfire.org>
   2
   3 patch based on acf69c946233259ab4d64f8869d4037a198c7f06
   4 From: Or Cohen <orcohen@paloaltonetworks.com>
   5 Subject: net/packet: fix overflow in tpacket_rcv
   6
   7 Using tp_reserve to calculate netoff can overflow as
   8 tp_reserve is unsigned int and netoff is unsigned short.
   9
  10 This may lead to macoff receving a smaller value then
  11 sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr
  12 is set, an out-of-bounds write will occur when
  13 calling virtio_net_hdr_from_skb.
  14
  15 The bug is fixed by converting netoff to unsigned int
  16 and checking if it exceeds USHRT_MAX.
  17
  18 This addresses CVE-2020-14386
  19
  20
  21 diff -Naur linux-4.14.197.org/net/packet/af_packet.c linux-4.14.197/net/packet/af_packet.c
  22 --- linux-4.14.197.org/net/packet/af_packet.c   2020-09-11 22:27:31.003458577 +0200
  23 +++ linux-4.14.197/net/packet/af_packet.c       2020-09-11 22:38:53.104021712 +0200
  24 @@ -2201,7 +2201,8 @@
  25         int skb_len = skb->len;
  26         unsigned int snaplen, res;
  27         unsigned long status = TP_STATUS_USER;
  28 -       unsigned short macoff, netoff, hdrlen;
  29 +       unsigned short macoff, hdrlen;
  30 +       unsigned int netoff;
  31         struct sk_buff *copy_skb = NULL;
  32         struct timespec ts;
  33         __u32 ts_status;
  34 @@ -2264,6 +2265,10 @@
  35                 }
  36                 macoff = netoff - maclen;
  37         }
  38 +       if (netoff > USHRT_MAX) {
  39 +               po->stats.stats1.tp_drops++;
  40 +               goto drop_n_restore;
  41 +       }
  42         if (po->tp_version <= TPACKET_V2) {
  43                 if (macoff + snaplen > po->rx_ring.frame_size) {
  44                         if (po->copy_thresh &&