diff options
author | David P <megver83@parabola.nu> | 2018-01-05 23:42:45 -0300 |
---|---|---|
committer | David P <megver83@parabola.nu> | 2018-01-05 23:42:45 -0300 |
commit | dba7d654b0f3fc1cf9a749467464016fc7b2b13b (patch) | |
tree | d2f421d6c6d4e15ac65a2ef80d6c2d0365573900 /libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch | |
parent | ea466373788409c3db888022adc1fff3c63a8d79 (diff) | |
download | abslibre-dba7d654b0f3fc1cf9a749467464016fc7b2b13b.tar.gz abslibre-dba7d654b0f3fc1cf9a749467464016fc7b2b13b.tar.bz2 abslibre-dba7d654b0f3fc1cf9a749467464016fc7b2b13b.zip |
libre/linux-libre: add Arch Linux security patches and fix objtool issue
Diffstat (limited to 'libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch')
-rw-r--r-- | libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch | 57 |
1 files changed, 57 insertions, 0 deletions
diff --git a/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch b/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch new file mode 100644 index 000000000..d7872e2a1 --- /dev/null +++ b/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch @@ -0,0 +1,57 @@ +From b81e273fb227373a2951c7256ab11a87d5333a9d Mon Sep 17 00:00:00 2001 +Message-Id: <b81e273fb227373a2951c7256ab11a87d5333a9d.1514959852.git.jan.steffens@gmail.com> +In-Reply-To: <fb89d912d5f7289d3a922c77b671e36e1c740f5e.1514959852.git.jan.steffens@gmail.com> +References: <fb89d912d5f7289d3a922c77b671e36e1c740f5e.1514959852.git.jan.steffens@gmail.com> +From: Mohamed Ghannam <simo.ghannam@gmail.com> +Date: Tue, 5 Dec 2017 20:58:35 +0000 +Subject: [PATCH 3/7] dccp: CVE-2017-8824: use-after-free in DCCP code + +Whenever the sock object is in DCCP_CLOSED state, +dccp_disconnect() must free dccps_hc_tx_ccid and +dccps_hc_rx_ccid and set to NULL. + +Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com> +Reviewed-by: Eric Dumazet <edumazet@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + net/dccp/proto.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index b68168fcc06aa198..9d43c1f4027408f3 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -259,25 +259,30 @@ int dccp_disconnect(struct sock *sk, int flags) + { + struct inet_connection_sock *icsk = inet_csk(sk); + struct inet_sock *inet = inet_sk(sk); ++ struct dccp_sock *dp = dccp_sk(sk); + int err = 0; + const int old_state = sk->sk_state; + + if (old_state != DCCP_CLOSED) + dccp_set_state(sk, DCCP_CLOSED); + + /* + * This corresponds to the ABORT function of RFC793, sec. 3.8 + * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted". + */ + if (old_state == DCCP_LISTEN) { + inet_csk_listen_stop(sk); + } else if (dccp_need_reset(old_state)) { + dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED); + sk->sk_err = ECONNRESET; + } else if (old_state == DCCP_REQUESTING) + sk->sk_err = ECONNRESET; + + dccp_clear_xmit_timers(sk); ++ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); ++ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); ++ dp->dccps_hc_rx_ccid = NULL; ++ dp->dccps_hc_tx_ccid = NULL; + + __skb_queue_purge(&sk->sk_receive_queue); + __skb_queue_purge(&sk->sk_write_queue); +-- +2.15.1 + |