| 1 |
commit: ac25f59e51d3946b9aa4491fa0ad9768cac30701 |
| 2 |
Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
| 3 |
AuthorDate: Mon Feb 27 18:32:21 2017 +0000 |
| 4 |
Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> |
| 5 |
CommitDate: Mon Feb 27 18:32:21 2017 +0000 |
| 6 |
URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=ac25f59e |
| 7 |
|
| 8 |
fix race condition in packet_set_ring. CVE-2016-8655. Bug #601926. |
| 9 |
|
| 10 |
0000_README | 4 ++ |
| 11 |
1530_CVE-2017-6074-dccp-fix-early-skb-free.patch | 47 ++++++++++++++++++++++++ |
| 12 |
2 files changed, 51 insertions(+) |
| 13 |
|
| 14 |
diff --git a/0000_README b/0000_README |
| 15 |
index 1216723..3c1164c 100644 |
| 16 |
--- a/0000_README |
| 17 |
+++ b/0000_README |
| 18 |
@@ -478,6 +478,10 @@ Patch: 1520_fix-race-condition-in-packet-set-ring.patch |
| 19 |
From: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=84ac7260236a49c79eede91617700174c2c19b0c |
| 20 |
Desc: packet: fix race condition in packet_set_ring. CVE-2016-8655. Bug #601926. |
| 21 |
|
| 22 |
+Patch: 1530_CVE-2017-6074-dccp-skb-freeing-fix.patch |
| 23 |
+From: https://bugs.gentoo.org/show_bug.cgi?id=610600 |
| 24 |
+Desc: dccp: fix freeing skb too early for IPV6_RECVPKTINFO. CVE-2017-6074 |
| 25 |
+ |
| 26 |
Patch: 1700_enable-thinkpad-micled.patch |
| 27 |
From: https://bugs.gentoo.org/show_bug.cgi?id=449248 |
| 28 |
Desc: Enable mic mute led in thinkpads |
| 29 |
|
| 30 |
diff --git a/1530_CVE-2017-6074-dccp-fix-early-skb-free.patch b/1530_CVE-2017-6074-dccp-fix-early-skb-free.patch |
| 31 |
new file mode 100644 |
| 32 |
index 0000000..433fd4b |
| 33 |
--- /dev/null |
| 34 |
+++ b/1530_CVE-2017-6074-dccp-fix-early-skb-free.patch |
| 35 |
@@ -0,0 +1,47 @@ |
| 36 |
+From 5edabca9d4cff7f1f2b68f0bac55ef99d9798ba4 Mon Sep 17 00:00:00 2001 |
| 37 |
+From: Andrey Konovalov <andreyknvl@××××××.com> |
| 38 |
+Date: Thu, 16 Feb 2017 17:22:46 +0100 |
| 39 |
+Subject: dccp: fix freeing skb too early for IPV6_RECVPKTINFO |
| 40 |
+ |
| 41 |
+In the current DCCP implementation an skb for a DCCP_PKT_REQUEST packet |
| 42 |
+is forcibly freed via __kfree_skb in dccp_rcv_state_process if |
| 43 |
+dccp_v6_conn_request successfully returns. |
| 44 |
+ |
| 45 |
+However, if IPV6_RECVPKTINFO is set on a socket, the address of the skb |
| 46 |
+is saved to ireq->pktopts and the ref count for skb is incremented in |
| 47 |
+dccp_v6_conn_request, so skb is still in use. Nevertheless, it gets freed |
| 48 |
+in dccp_rcv_state_process. |
| 49 |
+ |
| 50 |
+Fix by calling consume_skb instead of doing goto discard and therefore |
| 51 |
+calling __kfree_skb. |
| 52 |
+ |
| 53 |
+Similar fixes for TCP: |
| 54 |
+ |
| 55 |
+fb7e2399ec17f1004c0e0ccfd17439f8759ede01 [TCP]: skb is unexpectedly freed. |
| 56 |
+0aea76d35c9651d55bbaf746e7914e5f9ae5a25d tcp: SYN packets are now |
| 57 |
+simply consumed |
| 58 |
+ |
| 59 |
+Signed-off-by: Andrey Konovalov <andreyknvl@××××××.com> |
| 60 |
+Acked-by: Eric Dumazet <edumazet@××××××.com> |
| 61 |
+Signed-off-by: David S. Miller <davem@×××××××××.net> |
| 62 |
+--- |
| 63 |
+ net/dccp/input.c | 3 ++- |
| 64 |
+ 1 file changed, 2 insertions(+), 1 deletion(-) |
| 65 |
+ |
| 66 |
+diff --git a/net/dccp/input.c b/net/dccp/input.c |
| 67 |
+index ba34718..8fedc2d 100644 |
| 68 |
+--- a/net/dccp/input.c |
| 69 |
++++ b/net/dccp/input.c |
| 70 |
+@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, |
| 71 |
+ if (inet_csk(sk)->icsk_af_ops->conn_request(sk, |
| 72 |
+ skb) < 0) |
| 73 |
+ return 1; |
| 74 |
+- goto discard; |
| 75 |
++ consume_skb(skb); |
| 76 |
++ return 0; |
| 77 |
+ } |
| 78 |
+ if (dh->dccph_type == DCCP_PKT_RESET) |
| 79 |
+ goto discard; |
| 80 |
+-- |
| 81 |
+cgit v0.12 |
| 82 |
+ |
Archives