diff options
| author | Josh Boyer <jwboyer@fedoraproject.org> | 2016-05-23 08:16:50 -0400 |
|---|---|---|
| committer | Josh Boyer <jwboyer@fedoraproject.org> | 2016-05-23 08:21:31 -0400 |
| commit | 2532c1a7a3cd9389edf590cd0fd37f6552d9833b (patch) | |
| tree | b27a330f1b79973401aeed3d338fae6b3dfe4a20 | |
| parent | d6924f47270aa4a23133ce1dbb4ecf994c86b56d (diff) | |
| download | kernel-2532c1a7a3cd9389edf590cd0fd37f6552d9833b.tar.gz kernel-2532c1a7a3cd9389edf590cd0fd37f6552d9833b.tar.xz kernel-2532c1a7a3cd9389edf590cd0fd37f6552d9833b.zip | |
CVE-2016-4951 null ptr deref in tipc_nl_publ_dump (rhbz 1338625 1338626)
| -rw-r--r-- | kernel.spec | 6 | ||||
| -rw-r--r-- | tipc-check-nl-sock-before-parsing-nested-attributes.patch | 36 |
2 files changed, 42 insertions, 0 deletions
diff --git a/kernel.spec b/kernel.spec index 3da452968..c63a2a1a6 100644 --- a/kernel.spec +++ b/kernel.spec @@ -664,6 +664,9 @@ Patch718: KVM-MTRR-remove-MSR-0x2f8.patch #CVE-2016-4913 rhbz 1337528 1337529 Patch719: get_rock_ridge_filename-handle-malformed-NM-entries.patch +#CVE-2016-4951 rhbz 1338625 1338626 +Patch720: tipc-check-nl-sock-before-parsing-nested-attributes.patch + # END OF PATCH DEFINITIONS %endif @@ -2238,6 +2241,9 @@ fi # # %changelog +* Mon May 23 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2016-4951 null ptr deref in tipc_nl_publ_dump (rhbz 1338625 1338626) + * Thu May 19 2016 Josh Boyer <jwboyer@fedoraproject.org> - CVE-2016-4913 isofs: info leak with malformed NM entries (rhbz 1337528 1337529) diff --git a/tipc-check-nl-sock-before-parsing-nested-attributes.patch b/tipc-check-nl-sock-before-parsing-nested-attributes.patch new file mode 100644 index 000000000..09bfe1485 --- /dev/null +++ b/tipc-check-nl-sock-before-parsing-nested-attributes.patch @@ -0,0 +1,36 @@ +From 45e093ae2830cd1264677d47ff9a95a71f5d9f9c Mon Sep 17 00:00:00 2001 +From: Richard Alpe <richard.alpe@ericsson.com> +Date: Mon, 16 May 2016 11:14:54 +0200 +Subject: [PATCH] tipc: check nl sock before parsing nested attributes + +Make sure the socket for which the user is listing publication exists +before parsing the socket netlink attributes. + +Prior to this patch a call without any socket caused a NULL pointer +dereference in tipc_nl_publ_dump(). + +Tested-and-reported-by: Baozeng Ding <sploving1@gmail.com> +Signed-off-by: Richard Alpe <richard.alpe@ericsson.com> +Acked-by: Jon Maloy <jon.maloy@ericsson.cm> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + net/tipc/socket.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 12628890c219..3b7a79991d55 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2853,6 +2853,9 @@ int tipc_nl_publ_dump(struct sk_buff *skb, struct netlink_callback *cb) + if (err) + return err; + ++ if (!attrs[TIPC_NLA_SOCK]) ++ return -EINVAL; ++ + err = nla_parse_nested(sock, TIPC_NLA_SOCK_MAX, + attrs[TIPC_NLA_SOCK], + tipc_nl_sock_policy); +-- +2.5.5 + |