dccp: handle invalid feature options length
 

CVE-2011-1770
Integer underflow in the dccp_parse_options function
(net/dccp/options.c) in the Linux kernel before 2.6.33.14 allows
remote attackers to cause a denial of service via a Datagram
Congestion Control Protocol (DCCP) packet with an invalid feature
options length, which triggers a buffer over-read.

This problem was introduced in v2.6.29-rc1 and therefore does not affect
hardy. The fix for this has already hit lucid, natty, and oneiric via
mainline and stable. Following this email is a patch for: lucid/fsl-imx51,
maverick, maverick/ti-omap4, and natty/ti-omap4; this is a clean
cherry-pick from the upstream commit.

Proposing for lucid/fsl-imx51, maverick, maverick/ti-omap4, and natty/ti-omap4.

-apw

--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team

dccp: handle invalid feature options length
 

From: Dan Rosenberg <drosenberg@vsecurity.com>

A length of zero (after subtracting two for the type and len fields) for
the DCCPO_{CHANGE,CONFIRM}_{L,R} options will cause an underflow due to
the subtraction. The subsequent code may read past the end of the
options value buffer when parsing. I'm unsure of what the consequences
of this might be, but it's probably not good.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable@kernel.org
Acked-by: Gerrit Renker <gerrit@erg.abdn.ac.uk>
Signed-off-by: David S. Miller <davem@davemloft.net>

(cherry picked from commit a294865978b701e4d0d90135672749531b9a900d)
CVE-2011-1770
BugLink: http://bugs.launchpad.net/bugs/806375
Signed-off-by: Andy Whitcroft <apw@canonical.com>
---
net/dccp/options.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)

diff --git a/net/dccp/options.c b/net/dccp/options.c
index 1b08cae..b4a853e 100644
--- a/net/dccp/options.c
+++ b/net/dccp/options.c
@@ -131,6 +131,8 @@ int dccp_parse_options(struct sock *sk, struct dccp_request_sock *dreq,
case DCCPO_CHANGE_L ... DCCPO_CONFIRM_R:
if (pkt_type == DCCP_PKT_DATA) /* RFC 4340, 6 */
break;
+ if (len == 0)
+ goto out_invalid_option;
rc = dccp_feat_parse_options(sk, dreq, mandatory, opt,
*value, value + 1, len - 1);
if (rc)
--
1.7.4.1


--
kernel-team mailing list
kernel-team@lists.ubuntu.com
https://lists.ubuntu.com/mailman/listinfo/kernel-team