diff options
| author | Josh Boyer <jwboyer@fedoraproject.org> | 2016-05-23 08:16:50 -0400 |
|---|---|---|
| committer | Josh Boyer <jwboyer@fedoraproject.org> | 2016-05-23 08:16:50 -0400 |
| commit | c2d53823de43e5903a3e2b17d9f1758fe6251174 (patch) | |
| tree | f7a526f8696dbea918cc5f6dfb23c6a4f534f708 | |
| parent | 353ed7c540a8c13f44d8be4c0ade47c9d1765bbd (diff) | |
| download | kernel-c2d53823de43e5903a3e2b17d9f1758fe6251174.tar.gz kernel-c2d53823de43e5903a3e2b17d9f1758fe6251174.tar.xz kernel-c2d53823de43e5903a3e2b17d9f1758fe6251174.zip | |
CVE-2016-4951 null ptr deref in tipc_nl_publ_dump (rhbz 1338625 1338626)
| -rw-r--r-- | kernel.spec | 6 | ||||
| -rw-r--r-- | tipc-check-nl-sock-before-parsing-nested-attributes.patch | 36 |
2 files changed, 42 insertions, 0 deletions
diff --git a/kernel.spec b/kernel.spec index 776a9aaf6..804877219 100644 --- a/kernel.spec +++ b/kernel.spec @@ -661,6 +661,9 @@ Patch718: KVM-MTRR-remove-MSR-0x2f8.patch #CVE-2016-4440 rhbz 1337806 1337807 Patch719: kvm-vmx-more-complete-state-update-on-APICv-on-off.patch +#CVE-2016-4951 rhbz 1338625 1338626 +Patch720: tipc-check-nl-sock-before-parsing-nested-attributes.patch + # END OF PATCH DEFINITIONS %endif @@ -2178,6 +2181,9 @@ fi # # %changelog +* Mon May 23 2016 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2016-4951 null ptr deref in tipc_nl_publ_dump (rhbz 1338625 1338626) + * Fri May 20 2016 Justin M. Forbes <jforbes@fedoraproject.org> 4.5.5-201 - Remove the installonly additions until dnf can handle the transition diff --git a/tipc-check-nl-sock-before-parsing-nested-attributes.patch b/tipc-check-nl-sock-before-parsing-nested-attributes.patch new file mode 100644 index 000000000..09bfe1485 --- /dev/null +++ b/tipc-check-nl-sock-before-parsing-nested-attributes.patch @@ -0,0 +1,36 @@ +From 45e093ae2830cd1264677d47ff9a95a71f5d9f9c Mon Sep 17 00:00:00 2001 +From: Richard Alpe <richard.alpe@ericsson.com> +Date: Mon, 16 May 2016 11:14:54 +0200 +Subject: [PATCH] tipc: check nl sock before parsing nested attributes + +Make sure the socket for which the user is listing publication exists +before parsing the socket netlink attributes. + +Prior to this patch a call without any socket caused a NULL pointer +dereference in tipc_nl_publ_dump(). + +Tested-and-reported-by: Baozeng Ding <sploving1@gmail.com> +Signed-off-by: Richard Alpe <richard.alpe@ericsson.com> +Acked-by: Jon Maloy <jon.maloy@ericsson.cm> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + net/tipc/socket.c | 3 +++ + 1 file changed, 3 insertions(+) + +diff --git a/net/tipc/socket.c b/net/tipc/socket.c +index 12628890c219..3b7a79991d55 100644 +--- a/net/tipc/socket.c ++++ b/net/tipc/socket.c +@@ -2853,6 +2853,9 @@ int tipc_nl_publ_dump(struct sk_buff *skb, struct netlink_callback *cb) + if (err) + return err; + ++ if (!attrs[TIPC_NLA_SOCK]) ++ return -EINVAL; ++ + err = nla_parse_nested(sock, TIPC_NLA_SOCK_MAX, + attrs[TIPC_NLA_SOCK], + tipc_nl_sock_policy); +-- +2.5.5 + |