FAQ Search Today's Posts Mark Forums Read
» Video Reviews

» Linux Archive

Linux-archive is a website aiming to archive linux email lists and to make them easily accessible for linux users/developers.


» Sponsor

» Partners

» Sponsor

Go Back   Linux Archive > Ubuntu > Ubuntu Kernel Team

 
 
LinkBack Thread Tools
 
Old 01-28-2011, 07:37 PM
 
Default Hardy CVE-2010-3873, memory corruption in X.25 facilities parsing

The following changes since commit 726f4409a25c6c39b57efcb52375c9c5490c809d:
Linus Torvalds (1):
net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859

are available in the git repository at:

git://kernel.ubuntu.com/rtg/ubuntu-hardy.git CVE-2010-3873

andrew hendry (1):
memory corruption in X.25 facilities parsing, CVE-2010-3873

net/x25/x25_facilities.c | 8 ++++----
net/x25/x25_in.c | 11 +++++++----
2 files changed, 11 insertions(+), 8 deletions(-)
 
Old 01-31-2011, 07:53 AM
Stefan Bader
 
Default Hardy CVE-2010-3873, memory corruption in X.25 facilities parsing

On 01/28/2011 09:37 PM, Tim Gardner wrote:
> The following changes since commit 726f4409a25c6c39b57efcb52375c9c5490c809d:
> Linus Torvalds (1):
> net: Truncate recvfrom and sendto length to INT_MAX., CVE-2010-3859
>
> are available in the git repository at:
>
> git://kernel.ubuntu.com/rtg/ubuntu-hardy.git CVE-2010-3873
>
> andrew hendry (1):
> memory corruption in X.25 facilities parsing, CVE-2010-3873
>
> net/x25/x25_facilities.c | 8 ++++----
> net/x25/x25_in.c | 11 +++++++----
> 2 files changed, 11 insertions(+), 8 deletions(-)
>
> From 5f702dc29cadc092040622d1a653d74557da1834 Mon Sep 17 00:00:00 2001
> From: andrew hendry <andrew.hendry@gmail.com>
> Date: Wed, 3 Nov 2010 12:54:53 +0000
> Subject: [PATCH] memory corruption in X.25 facilities parsing, CVE-2010-3873
>
> BugLink: http://bugs.launchpad.net/bugs/709372
>
> CVE-2010-3873
>
> Backported from a6331d6f9a4298173b413cf99a40cc86a9d92c37
> by Tim Gardner <tim.gardner@canonical.com>
>
> Signed-of-by: Andrew Hendry <andrew.hendry@gmail.com>
>
> Signed-off-by: David S. Miller <davem@davemloft.net>
> Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
> ---
> net/x25/x25_facilities.c | 8 ++++----
> net/x25/x25_in.c | 11 +++++++----
> 2 files changed, 11 insertions(+), 8 deletions(-)
>
> diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
> index dec404a..fa5eb98 100644
> --- a/net/x25/x25_facilities.c
> +++ b/net/x25/x25_facilities.c
> @@ -126,15 +126,15 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
> case X25_FAC_CLASS_D:
> switch (*p) {
> case X25_FAC_CALLING_AE:
> - if (p[1] > X25_MAX_DTE_FACIL_LEN)
> - break;
> + if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
> + return 0;
> dte_facs->calling_len = p[2];
> memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
> *vc_fac_mask |= X25_MASK_CALLING_AE;
> break;
> case X25_FAC_CALLED_AE:
> - if (p[1] > X25_MAX_DTE_FACIL_LEN)
> - break;
> + if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
> + return 0;
> dte_facs->called_len = p[2];
> memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
> *vc_fac_mask |= X25_MASK_CALLED_AE;
> diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
> index 1c88762..4cae6cb 100644
> --- a/net/x25/x25_in.c
> +++ b/net/x25/x25_in.c
> @@ -93,6 +93,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
> switch (frametype) {
> case X25_CALL_ACCEPTED: {
> struct x25_sock *x25 = x25_sk(sk);
> + int len;
>
> x25_stop_timer(sk);
> x25->condition = 0x00;
> @@ -107,10 +108,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
> */
> skb_pull(skb, X25_STD_MIN_LEN);
> skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
> - skb_pull(skb,
> - x25_parse_facilities(skb, &x25->facilities,
> - &x25->dte_facilities,
> - &x25->vc_facil_mask));
> + len = x25_parse_facilities(skb, &x25->facilities,
> + &x25->dte_facilities, &x25->vc_facil_mask);
> + if (len <= 0)
> + return -1;
> + skb_pull(skb, len);
> +
> /*
> * Copy any Call User Data.
> */


--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team
 
Old 02-01-2011, 01:47 PM
Tim Gardner
 
Default Hardy CVE-2010-3873, memory corruption in X.25 facilities parsing

applied and pushed

--
Tim Gardner tim.gardner@canonical.com

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team
 

Thread Tools




All times are GMT. The time now is 10:24 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.
Copyright 2007 - 2008, www.linux-archive.org