Applied "check on BER decoding" security fix

diff --git a/lfs/linux b/lfs/linux
index 00e39e5df3cee721c139adad5ab28f223b5cf6be..3cefea1358390cdd84c3d8d6567d3e5aab4eb072 100644 (file)
--- a/lfs/linux
+++ b/lfs/linux
@@ -103,6 +103,9 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
        @rm -rf $(DIR_APP) $(DIR_SRC)/linux $(DIR_SRC)/xen-* && cd $(DIR_SRC) && tar jxf $(DIR_DL)/$(DL_FILE)
        ln -s linux-$(VER) /usr/src/linux
 
+       # Security fix for CIFS & Netfilter SNMP
+       cd $(DIR_APP) && patch -Np1 < $(DIR_SRC)/src/patches/linux-2.6.20.21-additional_check_on_BER_decoding.patch
+
        # Openswan 2
        cd $(DIR_SRC) && rm -rf openswan-*
        cd $(DIR_SRC) && tar xfz $(DIR_DL)/openswan-2.4.12.tar.gz

diff --git a/src/patches/linux-2.6.20.21-additional_check_on_BER_decoding.patch b/src/patches/linux-2.6.20.21-additional_check_on_BER_decoding.patch
new file mode 100644 (file)
index 0000000..c667af9
--- /dev/null
+++ b/src/patches/linux-2.6.20.21-additional_check_on_BER_decoding.patch
@@ -0,0 +1,133 @@
+From: Chris Wright <chrisw@sous-sol.org>
+Date: Wed, 4 Jun 2008 16:16:33 +0000 (-0700)
+Subject: asn1: additional sanity checking during BER decoding (CVE-2008-1673)
+X-Git-Tag: v2.6.25.5~1
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.25.y.git;a=commitdiff_plain;h=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c
+
+asn1: additional sanity checking during BER decoding (CVE-2008-1673)
+
+upstream commit: ddb2c43594f22843e9f3153da151deaba1a834c5
+
+- Don't trust a length which is greater than the working buffer.
+  An invalid length could cause overflow when calculating buffer size
+  for decoding oid.
+
+- An oid length of zero is invalid and allows for an off-by-one error when
+  decoding oid because the first subid actually encodes first 2 subids.
+
+- A primitive encoding may not have an indefinite length.
+
+Thanks to Wei Wang from McAfee for report.
+
+Cc: Steven French <sfrench@us.ibm.com>
+Cc: stable@kernel.org
+Acked-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+rediff for Linux-2.6.20.21 by Arne Fitzenreiter <arne_f@ipfire.org>
+---
+From: Chris Wright <chrisw@sous-sol.org>
+Date: Wed, 4 Jun 2008 16:16:33 +0000 (-0700)
+Subject: asn1: additional sanity checking during BER decoding (CVE-2008-1673)
+X-Git-Tag: v2.6.25.5~1
+X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Fstable%2Flinux-2.6.25.y.git;a=commitdiff_plain;h=33afb8403f361919aa5c8fe1d0a4f5ddbfbbea3c
+
+asn1: additional sanity checking during BER decoding (CVE-2008-1673)
+
+upstream commit: ddb2c43594f22843e9f3153da151deaba1a834c5
+
+- Don't trust a length which is greater than the working buffer.
+  An invalid length could cause overflow when calculating buffer size
+  for decoding oid.
+
+- An oid length of zero is invalid and allows for an off-by-one error when
+  decoding oid because the first subid actually encodes first 2 subids.
+
+- A primitive encoding may not have an indefinite length.
+
+Thanks to Wei Wang from McAfee for report.
+
+Cc: Steven French <sfrench@us.ibm.com>
+Cc: stable@kernel.org
+Acked-by: Patrick McHardy <kaber@trash.net>
+Signed-off-by: Chris Wright <chrisw@sous-sol.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+rediff for Linux-2.6.20.21 by Arne Fitzenreiter <arne_f@ipfire.org>
+---
+diff -Naur linux-2.6.20.21.org/fs/cifs/asn1.c linux-2.6.20.21/fs/cifs/asn1.c
+--- linux-2.6.20.21.org/fs/cifs/asn1.c 2007-10-17 21:31:14.000000000 +0200
++++ linux-2.6.20.21/fs/cifs/asn1.c     2008-06-10 00:09:43.000000000 +0200
+@@ -182,6 +182,11 @@
+                       }
+               }
+       }
++
++      /* don't trust len bigger than ctx buffer */
++      if (*len > ctx->end - ctx->pointer)
++              return 0;
++
+       return 1;
+ }
+ 
+@@ -199,6 +204,10 @@
+       if (!asn1_length_decode(ctx, &def, &len))
+               return 0;
+ 
++      /* primitive shall be definite, indefinite shall be constructed */
++      if (*con == ASN1_PRI && !def)
++              return 0;
++
+       if (def)
+               *eoc = ctx->pointer + len;
+       else
+@@ -385,6 +394,10 @@
+       unsigned long *optr;
+ 
+       size = eoc - ctx->pointer + 1;
++      
++      /* first subid actually encodes first two subids */
++      if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
++      return 0;
+       *oid = kmalloc(size * sizeof (unsigned long), GFP_ATOMIC);
+       if (*oid == NULL) {
+               return 0;
+diff -Naur linux-2.6.20.21.org/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.20.21/net/ipv4/netfilter/nf_nat_snmp_basic.c
+--- linux-2.6.20.21.org/net/ipv4/netfilter/nf_nat_snmp_basic.c 2007-10-17 21:31:14.000000000 +0200
++++ linux-2.6.20.21/net/ipv4/netfilter/nf_nat_snmp_basic.c     2008-06-10 00:03:59.000000000 +0200
+@@ -235,6 +235,11 @@
+                       }
+               }
+       }
++
++      /* don't trust len bigger than ctx buffer */
++      if (*len > ctx->end - ctx->pointer)
++              return 0;
++
+       return 1;
+ }
+ 
+@@ -253,6 +258,10 @@
+       if (!asn1_length_decode(ctx, &def, &len))
+               return 0;
+ 
++      /* primitive shall be definite, indefinite shall be constructed */
++      if (*con == ASN1_PRI && !def)
++              return 0;
++
+       if (def)
+               *eoc = ctx->pointer + len;
+       else
+@@ -437,6 +446,11 @@
+       unsigned long *optr;
+ 
+       size = eoc - ctx->pointer + 1;
++
++      /* first subid actually encodes first two subids */
++      if (size < 2 || size > ULONG_MAX/sizeof(unsigned long))
++              return 0;
++
+       *oid = kmalloc(size * sizeof(unsigned long), GFP_ATOMIC);
+       if (*oid == NULL) {
+               if (net_ratelimit())