From dba7d654b0f3fc1cf9a749467464016fc7b2b13b Mon Sep 17 00:00:00 2001 From: David P Date: Fri, 5 Jan 2018 23:42:45 -0300 Subject: libre/linux-libre: add Arch Linux security patches and fix objtool issue --- ...CVE-2017-8824-use-after-free-in-DCCP-code.patch | 57 ++++++++++++++++++++++ 1 file changed, 57 insertions(+) create mode 100644 libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch (limited to 'libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch') diff --git a/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch b/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch new file mode 100644 index 000000000..d7872e2a1 --- /dev/null +++ b/libre/linux-libre/0003-dccp-CVE-2017-8824-use-after-free-in-DCCP-code.patch @@ -0,0 +1,57 @@ +From b81e273fb227373a2951c7256ab11a87d5333a9d Mon Sep 17 00:00:00 2001 +Message-Id: +In-Reply-To: +References: +From: Mohamed Ghannam +Date: Tue, 5 Dec 2017 20:58:35 +0000 +Subject: [PATCH 3/7] dccp: CVE-2017-8824: use-after-free in DCCP code + +Whenever the sock object is in DCCP_CLOSED state, +dccp_disconnect() must free dccps_hc_tx_ccid and +dccps_hc_rx_ccid and set to NULL. + +Signed-off-by: Mohamed Ghannam +Reviewed-by: Eric Dumazet +Signed-off-by: David S. Miller +--- + net/dccp/proto.c | 5 +++++ + 1 file changed, 5 insertions(+) + +diff --git a/net/dccp/proto.c b/net/dccp/proto.c +index b68168fcc06aa198..9d43c1f4027408f3 100644 +--- a/net/dccp/proto.c ++++ b/net/dccp/proto.c +@@ -259,25 +259,30 @@ int dccp_disconnect(struct sock *sk, int flags) + { + struct inet_connection_sock *icsk = inet_csk(sk); + struct inet_sock *inet = inet_sk(sk); ++ struct dccp_sock *dp = dccp_sk(sk); + int err = 0; + const int old_state = sk->sk_state; + + if (old_state != DCCP_CLOSED) + dccp_set_state(sk, DCCP_CLOSED); + + /* + * This corresponds to the ABORT function of RFC793, sec. 3.8 + * TCP uses a RST segment, DCCP a Reset packet with Code 2, "Aborted". + */ + if (old_state == DCCP_LISTEN) { + inet_csk_listen_stop(sk); + } else if (dccp_need_reset(old_state)) { + dccp_send_reset(sk, DCCP_RESET_CODE_ABORTED); + sk->sk_err = ECONNRESET; + } else if (old_state == DCCP_REQUESTING) + sk->sk_err = ECONNRESET; + + dccp_clear_xmit_timers(sk); ++ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk); ++ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk); ++ dp->dccps_hc_rx_ccid = NULL; ++ dp->dccps_hc_tx_ccid = NULL; + + __skb_queue_purge(&sk->sk_receive_queue); + __skb_queue_purge(&sk->sk_write_queue); +-- +2.15.1 + -- cgit v1.2.3