]> git.baikalelectronics.ru Git - kernel.git/commit
dccp: don't duplicate ccid when cloning dccp sock
authorLin, Zhenpeng <zplin@psu.edu>
Wed, 8 Sep 2021 03:40:59 +0000 (03:40 +0000)
committerDavid S. Miller <davem@davemloft.net>
Wed, 8 Sep 2021 10:28:35 +0000 (11:28 +0100)
commit3b85373e2fad5144b9c0f6f3a62e5e14ff1a50b3
treed0a74cb2a2461ae0b2a870d693053f2551889343
parentc7fdc5c735b59f56c2701a8bac412e2d47c37124
dccp: don't duplicate ccid when cloning dccp sock

Commit fad4b88afc12 ("dccp: don't free ccid2_hc_tx_sock ...") fixed
a UAF but reintroduced CVE-2017-6074.

When the sock is cloned, two dccps_hc_tx_ccid will reference to the
same ccid. So one can free the ccid object twice from two socks after
cloning.

This issue was found by "Hadar Manor" as well and assigned with
CVE-2020-16119, which was fixed in Ubuntu's kernel. So here I port
the patch from Ubuntu to fix it.

The patch prevents cloned socks from referencing the same ccid.

Fixes: fad4b88afc12685 ("dccp: don't free ccid2_hc_tx_sock ...")
Signed-off-by: Zhenpeng Lin <zplin@psu.edu>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/dccp/minisocks.c