diff options
| author | Justin M. Forbes <jforbes@redhat.com> | 2016-12-07 11:25:59 -0600 |
|---|---|---|
| committer | Justin M. Forbes <jforbes@redhat.com> | 2016-12-07 11:25:59 -0600 |
| commit | 0c8cb1113fa14b237f37dc609cced4f4451a41db (patch) | |
| tree | 293b890c6202ebde6d5b6824115738d2cf1c7811 | |
| parent | f73ba7bcea33b3ef3d68b2fa42b50914dc5f61d0 (diff) | |
| download | kernel-0c8cb1113fa14b237f37dc609cced4f4451a41db.tar.gz kernel-0c8cb1113fa14b237f37dc609cced4f4451a41db.tar.xz kernel-0c8cb1113fa14b237f37dc609cced4f4451a41db.zip | |
CVE-2016-9793 avoid signed overflows for SO_{SND|RCV}BUFFORCE (rhbz 1402013 1402014)
| -rw-r--r-- | 0001-net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch | 49 | ||||
| -rw-r--r-- | kernel.spec | 6 |
2 files changed, 55 insertions, 0 deletions
diff --git a/0001-net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch b/0001-net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch new file mode 100644 index 000000000..6d5771ccd --- /dev/null +++ b/0001-net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch @@ -0,0 +1,49 @@ +From b98b0bc8c431e3ceb4b26b0dfc8db509518fb290 Mon Sep 17 00:00:00 2001 +From: Eric Dumazet <edumazet@google.com> +Date: Fri, 2 Dec 2016 09:44:53 -0800 +Subject: [PATCH] net: avoid signed overflows for SO_{SND|RCV}BUFFORCE + +CAP_NET_ADMIN users should not be allowed to set negative +sk_sndbuf or sk_rcvbuf values, as it can lead to various memory +corruptions, crashes, OOM... + +Note that before commit 82981930125a ("net: cleanups in +sock_setsockopt()"), the bug was even more serious, since SO_SNDBUF +and SO_RCVBUF were vulnerable. + +This needs to be backported to all known linux kernels. + +Again, many thanks to syzkaller team for discovering this gem. + +Signed-off-by: Eric Dumazet <edumazet@google.com> +Reported-by: Andrey Konovalov <andreyknvl@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- + net/core/sock.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +diff --git a/net/core/sock.c b/net/core/sock.c +index 5e3ca41..00a074d 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -715,7 +715,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, + val = min_t(u32, val, sysctl_wmem_max); + set_sndbuf: + sk->sk_userlocks |= SOCK_SNDBUF_LOCK; +- sk->sk_sndbuf = max_t(u32, val * 2, SOCK_MIN_SNDBUF); ++ sk->sk_sndbuf = max_t(int, val * 2, SOCK_MIN_SNDBUF); + /* Wake up sending tasks if we upped the value. */ + sk->sk_write_space(sk); + break; +@@ -751,7 +751,7 @@ int sock_setsockopt(struct socket *sock, int level, int optname, + * returning the value we actually used in getsockopt + * is the most desirable behavior. + */ +- sk->sk_rcvbuf = max_t(u32, val * 2, SOCK_MIN_RCVBUF); ++ sk->sk_rcvbuf = max_t(int, val * 2, SOCK_MIN_RCVBUF); + break; + + case SO_RCVBUFFORCE: +-- +2.9.3 + diff --git a/kernel.spec b/kernel.spec index 0626af1bb..076dd8536 100644 --- a/kernel.spec +++ b/kernel.spec @@ -648,6 +648,9 @@ Patch856: 0001-netfilter-ipv6-nf_defrag-drop-mangled-skb-on-ream-er.patch # CVE-2016-8655 rhbz 1400019 1401820 Patch857: 0001-packet-fix-race-condition-in-packet_set_ring.patch +# CVE-2016-9793 rhbz 1402013 1402014 +Patch858: 0001-net-avoid-signed-overflows-for-SO_-SND-RCV-BUFFORCE.patch + # END OF PATCH DEFINITIONS %endif @@ -2184,6 +2187,9 @@ fi # # %changelog +* Wed Dec 07 2016 Justin M. Forbes <jforbes@fedoraproject.org> +- CVE-2016-9793 avoid signed overflows for SO_{SND|RCV}BUFFORCE (rhbz 1402013 1402014) + * Tue Dec 06 2016 Justin M. Forbes <jforbes@fedoraproject.org> - CVE-2016-8655 fix race condition in packet_set_ring (rhbz 1400019 1401820) |