lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
ee4bb818ae
linux-kernel-test/net
History
Kirill Korotaev ee4bb818ae [NETFILTER]: Fix possible overflow in netfilters do_replace() 
netfilter's do_replace() can overflow on addition within SMP_ALIGN()
and/or on multiplication by NR_CPUS, resulting in a buffer overflow on
the copy_from_user().  In practice, the overflow on addition is
triggerable on all systems, whereas the multiplication one might require
much physical memory to be present due to the check above.  Either is
sufficient to overwrite arbitrary amounts of kernel memory.

I really hate adding the same check to all 4 versions of do_replace(),
but the code is duplicate...

Found by Solar Designer during security audit of OpenVZ.org

Signed-Off-By: Kirill Korotaev <dev@openvz.org>
Signed-Off-By: Solar Designer <solar@openwall.com>
Signed-off-by: Patrck McHardy <kaber@trash.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
2006-02-04 23:51:25 -08:00
..
802 [NET] snap: needs hardware checksum fix 2006-02-02 16:53:26 -08:00
8021q [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
appletalk [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
atm [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
ax25 [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
bluetooth [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
bridge [NETFILTER]: Fix possible overflow in netfilters do_replace() 2006-02-04 23:51:25 -08:00
core [BONDING]: Remove CAP_NET_ADMIN requirement for INFOQUERY ioctl 2006-01-24 12:46:33 -08:00
dccp [DCCP] ipv6: dccp_v6_send_response() has a DST leak too. 2006-01-31 17:53:37 -08:00
decnet [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
econet [ECONET]: Use macro for spinlock_t definition. 2006-01-04 13:56:08 -08:00
ethernet [NET]: Use newer is_multicast_ether_addr() in some files 2006-01-06 13:05:58 -08:00
ieee80211 [PATCH] Typo corrections for ieee80211 2006-01-30 17:41:36 -05:00
ipv4 [NETFILTER]: Fix possible overflow in netfilters do_replace() 2006-02-04 23:51:25 -08:00
ipv6 [NETFILTER]: Fix possible overflow in netfilters do_replace() 2006-02-04 23:51:25 -08:00
ipx [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
irda [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
key [AF_KEY]: no message type set 2006-01-24 12:57:19 -08:00
lapb [NET]: Kill skb->list 2005-08-29 15:31:14 -07:00
llc [NET]: Add a dev_ioctl() fallback to sock_ioctl() 2006-01-03 14:18:33 -08:00
netfilter [NETFILTER]: nf_conntrack: fix incorrect memset() size in FTP helper 2006-02-04 23:51:23 -08:00
netlink [PATCH] genetlink: don't touch module ref count 2006-01-13 13:06:40 -08:00
netrom [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
packet [NET]: Fix some whitespace issues in af_packet.c 2006-01-23 16:28:02 -08:00
rose [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
rxrpc [NET]: "signed long" -> "long" 2006-01-17 13:03:54 -08:00
sched [PKT_SCHED]: Handle SCTP/DCCP in sfq_hash 2006-01-17 13:01:06 -08:00
sctp [SCTP]: Fix 'fast retransmit' to send a TSN only once. 2006-02-02 16:57:31 -08:00
sunrpc SUNRPC: Move upcall out of auth->au_ops->crcreate() 2006-02-01 12:52:25 -05:00
tipc [TIPC] Avoid polluting the global namespace 2006-01-18 00:45:16 +01:00
unix [PATCH] mutex subsystem, semaphore to mutex: VFS, ->i_sem 2006-01-09 15:59:24 -08:00
wanrouter [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
x25 [PATCH] capable/capability.h (net/) 2006-01-11 18:42:14 -08:00
xfrm [NET]: Change some "if (x) BUG();" to "BUG_ON(x);" 2006-01-09 14:16:18 -08:00
compat.c [PATCH] Fix 32bit sendmsg() flaw 2005-09-08 08:14:11 -07:00
Kconfig [NET]: Add CONFIG_NETDEBUG to suppress bad packet messages. 2006-02-02 20:40:09 -08:00
Makefile [TIPC] Initial merge 2006-01-12 14:06:31 -08:00
nonet.c [NET]: Fix sock_init() return value. 2006-01-03 13:11:17 -08:00
socket.c [NET]: Remove more unneeded typecasts on *malloc() 2006-01-11 16:32:14 -08:00
sysctl_net.c [NET]: Fix "sysctl_net.c:36: error: 'core_table' undeclared here" 2005-10-03 14:16:34 -07:00
TUNABLE Linux-2.6.12-rc2 2005-04-16 15:20:36 -07:00