From c380c25c485c1a2ef86f89a9e2b971c55f3c1b2c Mon Sep 17 00:00:00 2001 From: Andreas Wellving Date: Wed, 17 Oct 2018 14:46:59 +0200 Subject: net/packet: CVE-2017-7308 net/packet: fix overflow in check for priv area size References: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?h=linux-4.1.y&id=dd07486ceba48b5d2157b212bb9bd5ce9a46b593 Change-Id: I21713abf14677f885f66c627fa0e83dbde286237 Signed-off-by: Andreas Wellving --- ...-fix-overflow-in-check-for-priv-area-size.patch | 44 ++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 patches/cve/CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch (limited to 'patches/cve/CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch') diff --git a/patches/cve/CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch b/patches/cve/CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch new file mode 100644 index 0000000..fbad094 --- /dev/null +++ b/patches/cve/CVE-2017-7308-net-packet-fix-overflow-in-check-for-priv-area-size.patch @@ -0,0 +1,44 @@ +From dd07486ceba48b5d2157b212bb9bd5ce9a46b593 Mon Sep 17 00:00:00 2001 +From: Andrey Konovalov +Date: Wed, 29 Mar 2017 16:11:20 +0200 +Subject: [PATCH] net/packet: fix overflow in check for priv area size + +[ Upstream commit 2b6867c2ce76c596676bec7d2d525af525fdc6e2 ] + +Subtracting tp_sizeof_priv from tp_block_size and casting to int +to check whether one is less then the other doesn't always work +(both of them are unsigned ints). + +Compare them as is instead. + +Also cast tp_sizeof_priv to u64 before using BLK_PLUS_PRIV, as +it can overflow inside BLK_PLUS_PRIV otherwise. + +CVE: CVE-2017-7308 +Upstream-Status: Backport + +Signed-off-by: Andrey Konovalov +Acked-by: Eric Dumazet +Signed-off-by: David S. Miller +Signed-off-by: Sasha Levin +Signed-off-by: Andreas Wellving +--- + net/packet/af_packet.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index b9d1baa..83c05aa 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -3867,8 +3867,8 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + if (unlikely(req->tp_block_size & (PAGE_SIZE - 1))) + goto out; + if (po->tp_version >= TPACKET_V3 && +- (int)(req->tp_block_size - +- BLK_PLUS_PRIV(req_u->req3.tp_sizeof_priv)) <= 0) ++ req->tp_block_size <= ++ BLK_PLUS_PRIV((u64)req_u->req3.tp_sizeof_priv)) + goto out; + if (unlikely(req->tp_frame_size < po->tp_hdrlen + + po->tp_reserve)) +-- -- cgit v1.2.3-54-g00ecf