]> git.baikalelectronics.ru Git - kernel.git/commit
udp: prevent bugcheck if filter truncates packet too much
authorMichal Kubeček <mkubecek@suse.cz>
Fri, 8 Jul 2016 15:52:33 +0000 (17:52 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 11 Jul 2016 19:43:15 +0000 (12:43 -0700)
commitb9ce4a78686de990626622dfe37f9f548f8fa083
tree6d8340d073fd7465158f130e1bbe23429956f3b0
parent3e3416797a39903e7674077840f6c4a42fac0797
udp: prevent bugcheck if filter truncates packet too much

If socket filter truncates an udp packet below the length of UDP header
in udpv6_queue_rcv_skb() or udp_queue_rcv_skb(), it will trigger a
BUG_ON in skb_pull_rcsum(). This BUG_ON (and therefore a system crash if
kernel is configured that way) can be easily enforced by an unprivileged
user which was reported as CVE-2016-6162. For a reproducer, see
http://seclists.org/oss-sec/2016/q3/8

Fixes: 44fa15a2618b ("udp: remove headers from UDP packets before queueing")
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/udp.c
net/ipv6/udp.c