Linux Archive

Linux Archive (http://www.linux-archive.org/)
-   Ubuntu Kernel Team (http://www.linux-archive.org/ubuntu-kernel-team/)
-   -   memory corruption in X.25 facilities parsing, CVE-2010-3873 (http://www.linux-archive.org/ubuntu-kernel-team/482549-memory-corruption-x-25-facilities-parsing-cve-2010-3873-a.html)

andrew hendry 11-03-2010 11:54 AM

memory corruption in X.25 facilities parsing, CVE-2010-3873
 
BugLink: http://bugs.launchpad.net/bugs/709372

CVE-2010-3873

Backported from a6331d6f9a4298173b413cf99a40cc86a9d92c37
by Tim Gardner <tim.gardner@canonical.com>

Signed-of-by: Andrew Hendry <andrew.hendry@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
net/x25/x25_facilities.c | 8 ++++----
net/x25/x25_in.c | 11 +++++++----
2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index dec404a..fa5eb98 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -126,15 +126,15 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
case X25_FAC_CLASS_D:
switch (*p) {
case X25_FAC_CALLING_AE:
- if (p[1] > X25_MAX_DTE_FACIL_LEN)
- break;
+ if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+ return 0;
dte_facs->calling_len = p[2];
memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
*vc_fac_mask |= X25_MASK_CALLING_AE;
break;
case X25_FAC_CALLED_AE:
- if (p[1] > X25_MAX_DTE_FACIL_LEN)
- break;
+ if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+ return 0;
dte_facs->called_len = p[2];
memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
*vc_fac_mask |= X25_MASK_CALLED_AE;
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 1c88762..4cae6cb 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -93,6 +93,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
switch (frametype) {
case X25_CALL_ACCEPTED: {
struct x25_sock *x25 = x25_sk(sk);
+ int len;

x25_stop_timer(sk);
x25->condition = 0x00;
@@ -107,10 +108,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
*/
skb_pull(skb, X25_STD_MIN_LEN);
skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
- skb_pull(skb,
- x25_parse_facilities(skb, &x25->facilities,
- &x25->dte_facilities,
- &x25->vc_facil_mask));
+ len = x25_parse_facilities(skb, &x25->facilities,
+ &x25->dte_facilities, &x25->vc_facil_mask);
+ if (len <= 0)
+ return -1;
+ skb_pull(skb, len);
+
/*
* Copy any Call User Data.
*/
--
1.7.0.4


--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

andrew hendry 11-03-2010 11:54 AM

memory corruption in X.25 facilities parsing, CVE-2010-3873
 
BugLink: http://bugs.launchpad.net/bugs/709372

CVE-2010-3873

Backported from a6331d6f9a4298173b413cf99a40cc86a9d92c37
by Tim Gardner <tim.gardner@canonical.com>

Signed-of-by: Andrew Hendry <andrew.hendry@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
net/x25/x25_facilities.c | 8 ++++----
net/x25/x25_in.c | 11 +++++++----
2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index a21f664..e233de3 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -126,15 +126,15 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
case X25_FAC_CLASS_D:
switch (*p) {
case X25_FAC_CALLING_AE:
- if (p[1] > X25_MAX_DTE_FACIL_LEN)
- break;
+ if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+ return 0;
dte_facs->calling_len = p[2];
memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
*vc_fac_mask |= X25_MASK_CALLING_AE;
break;
case X25_FAC_CALLED_AE:
- if (p[1] > X25_MAX_DTE_FACIL_LEN)
- break;
+ if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+ return 0;
dte_facs->called_len = p[2];
memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
*vc_fac_mask |= X25_MASK_CALLED_AE;
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 7d7c3ab..b68dbac 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -93,6 +93,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
switch (frametype) {
case X25_CALL_ACCEPTED: {
struct x25_sock *x25 = x25_sk(sk);
+ int len;

x25_stop_timer(sk);
x25->condition = 0x00;
@@ -107,10 +108,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
*/
skb_pull(skb, X25_STD_MIN_LEN);
skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
- skb_pull(skb,
- x25_parse_facilities(skb, &x25->facilities,
- &x25->dte_facilities,
- &x25->vc_facil_mask));
+ len = x25_parse_facilities(skb, &x25->facilities,
+ &x25->dte_facilities, &x25->vc_facil_mask);
+ if (len <= 0)
+ return -1;
+ skb_pull(skb, len);
+
/*
* Copy any Call User Data.
*/
--
1.7.0.4


--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

andrew hendry 11-03-2010 11:54 AM

memory corruption in X.25 facilities parsing, CVE-2010-3873
 
BugLink: http://bugs.launchpad.net/bugs/709372

CVE-2010-3873

Backported from a6331d6f9a4298173b413cf99a40cc86a9d92c37
by Tim Gardner <tim.gardner@canonical.com>

Signed-of-by: Andrew Hendry <andrew.hendry@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
net/x25/x25_facilities.c | 8 ++++----
net/x25/x25_in.c | 11 +++++++----
2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index dec404a..fa5eb98 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -126,15 +126,15 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
case X25_FAC_CLASS_D:
switch (*p) {
case X25_FAC_CALLING_AE:
- if (p[1] > X25_MAX_DTE_FACIL_LEN)
- break;
+ if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+ return 0;
dte_facs->calling_len = p[2];
memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
*vc_fac_mask |= X25_MASK_CALLING_AE;
break;
case X25_FAC_CALLED_AE:
- if (p[1] > X25_MAX_DTE_FACIL_LEN)
- break;
+ if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+ return 0;
dte_facs->called_len = p[2];
memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
*vc_fac_mask |= X25_MASK_CALLED_AE;
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 1c88762..5677d0e 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -93,6 +93,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
switch (frametype) {
case X25_CALL_ACCEPTED: {
struct x25_sock *x25 = x25_sk(sk);
+ int len;

x25_stop_timer(sk);
x25->condition = 0x00;
@@ -107,10 +108,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
*/
skb_pull(skb, X25_STD_MIN_LEN);
skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
- skb_pull(skb,
- x25_parse_facilities(skb, &x25->facilities,
- &x25->dte_facilities,
- &x25->vc_facil_mask));
+ len = x25_parse_facilities(skb, &x25->facilities,
+ &x25->dte_facilities, &x25->vc_facil_mask);
+ if (len <= 0)
+ return 0;
+ skb_pull(skb, len);
+
/*
* Copy any Call User Data.
*/
--
1.7.0.4


--------------030606030306090006070009
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

--------------030606030306090006070009--

andrew hendry 11-03-2010 11:54 AM

memory corruption in X.25 facilities parsing, CVE-2010-3873
 
BugLink: http://bugs.launchpad.net/bugs/709372

CVE-2010-3873

Backported from a6331d6f9a4298173b413cf99a40cc86a9d92c37
by Tim Gardner <tim.gardner@canonical.com>

Signed-of-by: Andrew Hendry <andrew.hendry@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
net/x25/x25_facilities.c | 8 ++++----
net/x25/x25_in.c | 11 +++++++----
2 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/net/x25/x25_facilities.c b/net/x25/x25_facilities.c
index a21f664..e233de3 100644
--- a/net/x25/x25_facilities.c
+++ b/net/x25/x25_facilities.c
@@ -126,15 +126,15 @@ int x25_parse_facilities(struct sk_buff *skb, struct x25_facilities *facilities,
case X25_FAC_CLASS_D:
switch (*p) {
case X25_FAC_CALLING_AE:
- if (p[1] > X25_MAX_DTE_FACIL_LEN)
- break;
+ if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+ return 0;
dte_facs->calling_len = p[2];
memcpy(dte_facs->calling_ae, &p[3], p[1] - 1);
*vc_fac_mask |= X25_MASK_CALLING_AE;
break;
case X25_FAC_CALLED_AE:
- if (p[1] > X25_MAX_DTE_FACIL_LEN)
- break;
+ if (p[1] > X25_MAX_DTE_FACIL_LEN || p[1] <= 1)
+ return 0;
dte_facs->called_len = p[2];
memcpy(dte_facs->called_ae, &p[3], p[1] - 1);
*vc_fac_mask |= X25_MASK_CALLED_AE;
diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 7d7c3ab..45d6c22 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -93,6 +93,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
switch (frametype) {
case X25_CALL_ACCEPTED: {
struct x25_sock *x25 = x25_sk(sk);
+ int len;

x25_stop_timer(sk);
x25->condition = 0x00;
@@ -107,10 +108,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
*/
skb_pull(skb, X25_STD_MIN_LEN);
skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
- skb_pull(skb,
- x25_parse_facilities(skb, &x25->facilities,
- &x25->dte_facilities,
- &x25->vc_facil_mask));
+ len = x25_parse_facilities(skb, &x25->facilities,
+ &x25->dte_facilities, &x25->vc_facil_mask);
+ if (len <= 0)
+ return 0;
+ skb_pull(skb, len);
+
/*
* Copy any Call User Data.
*/
--
1.7.0.4


--------------070507090102060703020007
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

--------------070507090102060703020007--

Tim Gardner 01-28-2011 05:17 PM

memory corruption in X.25 facilities parsing, CVE-2010-3873
 
BugLink: http://bugs.launchpad.net/bugs/709372

CVE-2010-3873

Partial backport from a6331d6f9a4298173b413cf99a40cc86a9d92c37
by Tim Gardner <tim.gardner@canonical.com>

Signed-of-by: Andrew Hendry <andrew.hendry@gmail.com>

Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>
---
net/x25/x25_in.c | 10 +++++++---
1 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/net/x25/x25_in.c b/net/x25/x25_in.c
index 2614687..85eb3cb 100644
--- a/net/x25/x25_in.c
+++ b/net/x25/x25_in.c
@@ -90,6 +90,7 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
switch (frametype) {
case X25_CALL_ACCEPTED: {
struct x25_sock *x25 = x25_sk(sk);
+ int len;

x25_stop_timer(sk);
x25->condition = 0x00;
@@ -104,9 +105,12 @@ static int x25_state1_machine(struct sock *sk, struct sk_buff *skb, int frametyp
*/
skb_pull(skb, X25_STD_MIN_LEN);
skb_pull(skb, x25_addr_ntoa(skb->data, &source_addr, &dest_addr));
- skb_pull(skb,
- x25_parse_facilities(skb, &x25->facilities,
- &x25->vc_facil_mask));
+ len = x25_parse_facilities(skb, &x25->facilities,
+ &x25->vc_facil_mask);
+ if (len <= 0)
+ return 0;
+ skb_pull(skb, len);
+
/*
* Copy any Call User Data.
*/
--
1.7.0.4


--------------020608040004080505050903
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

--------------020608040004080505050903--


All times are GMT. The time now is 10:02 PM.

VBulletin, Copyright ©2000 - 2014, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO ©2007, Crawlability, Inc.