FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Ubuntu > Ubuntu Kernel Team

 
 
LinkBack Thread Tools
 
Old 01-27-2011, 08:19 PM
 
Default Karmic SRU, CVE-2010-3859

The following changes since commit 8f57f1af10280643dcfda5da7233be6bc211dad5:
Tim Gardner (1):
Karmic SRU: thinkpad-acpi: lock down video output state access, CVE-2010-3448

are available in the git repository at:

git://kernel.ubuntu.com/rtg/ubuntu-karmic.git CVE-2010-3859

David S. Miller (1):
net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859

Linus Torvalds (1):
net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859

net/compat.c | 10 ++++++----
net/core/iovec.c | 15 +++++++--------
net/socket.c | 4 ++++
3 files changed, 17 insertions(+), 12 deletions(-)
 
Old 01-28-2011, 08:43 AM
Stefan Bader
 
Default Karmic SRU, CVE-2010-3859

Looks to be following the upstream change (minus the change of the variable from
long to int).

On 01/27/2011 10:19 PM, Tim Gardner wrote:
> The following changes since commit 8f57f1af10280643dcfda5da7233be6bc211dad5:
> Tim Gardner (1):
> Karmic SRU: thinkpad-acpi: lock down video output state access, CVE-2010-3448
>
> are available in the git repository at:
>
> git://kernel.ubuntu.com/rtg/ubuntu-karmic.git CVE-2010-3859
>
> David S. Miller (1):
> net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859
>
> Linus Torvalds (1):
> net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859
>
> net/compat.c | 10 ++++++----
> net/core/iovec.c | 15 +++++++--------
> net/socket.c | 4 ++++
> 3 files changed, 17 insertions(+), 12 deletions(-)
>
> From 6f26927146d324dacc6b62e7e45f7c1e9d957760 Mon Sep 17 00:00:00 2001
> From: David S. Miller <davem@davemloft.net>
> Date: Thu, 28 Oct 2010 11:41:55 -0700
> Subject: [PATCH 1/2] net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859
>
> BugLink: http://bugs.launchpad.net/bugs/708839
>
> CVE-2010-3859
>
> commit 8acfe468b0384e834a303f08ebc4953d72fb690a upstream.
> Backported as far as 2.6.23.26
>
> This helps protect us from overflow issues down in the
> individual protocol sendmsg/recvmsg handlers. Once
> we hit INT_MAX we truncate out the rest of the iovec
> by setting the iov_len members to zero.
>
> This works because:
>
> 1) For SOCK_STREAM and SOCK_SEQPACKET sockets, partial
> writes are allowed and the application will just continue
> with another write to send the rest of the data.
>
> 2) For datagram oriented sockets, where there must be a
> one-to-one correspondance between write() calls and
> packets on the wire, INT_MAX is going to be far larger
> than the packet size limit the protocol is going to
> check for and signal with -EMSGSIZE.
>
> Based upon a patch by Linus Torvalds.
>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
> ---
> net/compat.c | 10 ++++++----
> net/core/iovec.c | 15 +++++++--------
> 2 files changed, 13 insertions(+), 12 deletions(-)
>
> diff --git a/net/compat.c b/net/compat.c
> index 8d73905..2a2659b 100644
> --- a/net/compat.c
> +++ b/net/compat.c
> @@ -40,10 +40,12 @@ static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
> compat_size_t len;
>
> if (get_user(len, &uiov32->iov_len) ||
> - get_user(buf, &uiov32->iov_base)) {
> - tot_len = -EFAULT;
> - break;
> - }
> + get_user(buf, &uiov32->iov_base))
> + return -EFAULT;
> +
> + if (len > INT_MAX - tot_len)
> + len = INT_MAX - tot_len;
> +
> tot_len += len;
> kiov->iov_base = compat_ptr(buf);
> kiov->iov_len = (__kernel_size_t) len;
> diff --git a/net/core/iovec.c b/net/core/iovec.c
> index 16ad45d..b6a4780 100644
> --- a/net/core/iovec.c
> +++ b/net/core/iovec.c
> @@ -60,14 +60,13 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
> err = 0;
>
> for (ct = 0; ct < m->msg_iovlen; ct++) {
> - err += iov[ct].iov_len;
> - /*
> - * Goal is not to verify user data, but to prevent returning
> - * negative value, which is interpreted as errno.
> - * Overflow is still possible, but it is harmless.
> - */
> - if (err < 0)
> - return -EMSGSIZE;
> + size_t len = iov[ct].iov_len;
> +
> + if (len > INT_MAX - err) {
> + len = INT_MAX - err;
> + iov[ct].iov_len = len;
> + }
> + err += len;
> }
>
> return err;


--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team
 
Old 01-28-2011, 03:16 PM
Brad Figg
 
Default Karmic SRU, CVE-2010-3859

On 01/27/2011 01:19 PM, Tim Gardner wrote:

The following changes since commit 8f57f1af10280643dcfda5da7233be6bc211dad5:
Tim Gardner (1):
Karmic SRU: thinkpad-acpi: lock down video output state access, CVE-2010-3448

are available in the git repository at:

git://kernel.ubuntu.com/rtg/ubuntu-karmic.git CVE-2010-3859

David S. Miller (1):
net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859

Linus Torvalds (1):
net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859

net/compat.c | 10 ++++++----
net/core/iovec.c | 15 +++++++--------
net/socket.c | 4 ++++
3 files changed, 17 insertions(+), 12 deletions(-)

From 6f26927146d324dacc6b62e7e45f7c1e9d957760 Mon Sep 17 00:00:00 2001
From: David S. Miller<davem@davemloft.net>
Date: Thu, 28 Oct 2010 11:41:55 -0700
Subject: [PATCH 1/2] net: Limit socket I/O iovec total length to INT_MAX., CVE-2010-3859

BugLink: http://bugs.launchpad.net/bugs/708839

CVE-2010-3859

commit 8acfe468b0384e834a303f08ebc4953d72fb690a upstream.
Backported as far as 2.6.23.26

This helps protect us from overflow issues down in the
individual protocol sendmsg/recvmsg handlers. Once
we hit INT_MAX we truncate out the rest of the iovec
by setting the iov_len members to zero.

This works because:

1) For SOCK_STREAM and SOCK_SEQPACKET sockets, partial
writes are allowed and the application will just continue
with another write to send the rest of the data.

2) For datagram oriented sockets, where there must be a
one-to-one correspondance between write() calls and
packets on the wire, INT_MAX is going to be far larger
than the packet size limit the protocol is going to
check for and signal with -EMSGSIZE.

Based upon a patch by Linus Torvalds.

Signed-off-by: David S. Miller<davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman<gregkh@suse.de>
Signed-off-by: Tim Gardner<tim.gardner@canonical.com>
---
net/compat.c | 10 ++++++----
net/core/iovec.c | 15 +++++++--------
2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/net/compat.c b/net/compat.c
index 8d73905..2a2659b 100644
--- a/net/compat.c
+++ b/net/compat.c
@@ -40,10 +40,12 @@ static inline int iov_from_user_compat_to_kern(struct iovec *kiov,
compat_size_t len;

if (get_user(len,&uiov32->iov_len) ||
- get_user(buf,&uiov32->iov_base)) {
- tot_len = -EFAULT;
- break;
- }
+ get_user(buf,&uiov32->iov_base))
+ return -EFAULT;
+
+ if (len> INT_MAX - tot_len)
+ len = INT_MAX - tot_len;
+
tot_len += len;
kiov->iov_base = compat_ptr(buf);
kiov->iov_len = (__kernel_size_t) len;
diff --git a/net/core/iovec.c b/net/core/iovec.c
index 16ad45d..b6a4780 100644
--- a/net/core/iovec.c
+++ b/net/core/iovec.c
@@ -60,14 +60,13 @@ int verify_iovec(struct msghdr *m, struct iovec *iov, struct sockaddr *address,
err = 0;

for (ct = 0; ct< m->msg_iovlen; ct++) {
- err += iov[ct].iov_len;
- /*
- * Goal is not to verify user data, but to prevent returning
- * negative value, which is interpreted as errno.
- * Overflow is still possible, but it is harmless.
- */
- if (err< 0)
- return -EMSGSIZE;
+ size_t len = iov[ct].iov_len;
+
+ if (len> INT_MAX - err) {
+ len = INT_MAX - err;
+ iov[ct].iov_len = len;
+ }
+ err += len;
}

return err;


Acked-by: Brad Figg <brad.figg@canonical.com>

--
Brad Figg brad.figg@canonical.com http://www.canonical.com

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team
 
Old 01-28-2011, 03:54 PM
Tim Gardner
 
Default Karmic SRU, CVE-2010-3859

applied and pushed

--
Tim Gardner tim.gardner@canonical.com

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team
 

Thread Tools




All times are GMT. The time now is 09:31 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org