diff options
| -rw-r--r-- | PatchList.txt | 3 | ||||
| -rw-r--r-- | kernel.spec | 9 | ||||
| -rw-r--r-- | net-flow_dissector-fail-on-evil-iph-ihl.patch | 82 |
3 files changed, 94 insertions, 0 deletions
diff --git a/PatchList.txt b/PatchList.txt index a96ac6ecc..dd261935e 100644 --- a/PatchList.txt +++ b/PatchList.txt @@ -1,5 +1,8 @@ **** Backports and patches headed/already upsteram ***************************** +* net-flow_dissector-fail-on-evil-iph-ihl.patch (rhbz 1007939 1025647) + - Should hit upstream and stable soon + * alps-Support-for-Dell-XT2-model.patch (rhbz 1023413) - http://article.gmane.org/gmane.linux.kernel.input/32484 diff --git a/kernel.spec b/kernel.spec index d7de7c982..8ce79f75d 100644 --- a/kernel.spec +++ b/kernel.spec @@ -736,6 +736,9 @@ Patch25132: rt2800usb-slow-down-TX-status-polling.patch #rhbz 1023413 Patch25133: alps-Support-for-Dell-XT2-model.patch +#CVE-2013-4348 rhbz 1007939 1025647 +Patch25139: net-flow_dissector-fail-on-evil-iph-ihl.patch + # END OF PATCH DEFINITIONS %endif @@ -1441,6 +1444,9 @@ ApplyPatch rt2800usb-slow-down-TX-status-polling.patch #rhbz 1023413 ApplyPatch alps-Support-for-Dell-XT2-model.patch +#CVE-2013-4348 rhbz 1007939 1025647 +ApplyPatch net-flow_dissector-fail-on-evil-iph-ihl.patch + # END OF PATCH APPLICATIONS %endif @@ -2244,6 +2250,9 @@ fi # ||----w | # || || %changelog +* Fri Nov 01 2013 Josh Boyer <jwboyer@fedoraproject.org> +- CVE-2013-4348 net: deadloop path in skb_flow_dissect (rhbz 1007939 1025647) + * Thu Oct 31 2013 Josh Boyer <jwboyer@fedoraproject.org> - 3.12.0-0.rc7.git2.1 - Linux v3.12-rc7-48-g12aee27 diff --git a/net-flow_dissector-fail-on-evil-iph-ihl.patch b/net-flow_dissector-fail-on-evil-iph-ihl.patch new file mode 100644 index 000000000..aba3ea88b --- /dev/null +++ b/net-flow_dissector-fail-on-evil-iph-ihl.patch @@ -0,0 +1,82 @@ +Path: news.gmane.org!not-for-mail +From: Jason Wang <jasowang@redhat.com> +Newsgroups: gmane.linux.kernel,gmane.linux.network +Subject: [PATCH net] net: flow_dissector: fail on evil iph->ihl +Date: Fri, 1 Nov 2013 15:01:10 +0800 +Lines: 34 +Approved: news@gmane.org +Message-ID: <1383289270-18952-1-git-send-email-jasowang@redhat.com> +NNTP-Posting-Host: plane.gmane.org +X-Trace: ger.gmane.org 1383289296 18578 80.91.229.3 (1 Nov 2013 07:01:36 GMT) +X-Complaints-To: usenet@ger.gmane.org +NNTP-Posting-Date: Fri, 1 Nov 2013 07:01:36 +0000 (UTC) +Cc: Jason Wang <jasowang@redhat.com>, + Petr Matousek <pmatouse@redhat.com>, + "Michael S. Tsirkin" <mst@redhat.com>, + Daniel Borkmann <dborkman@redhat.com> +To: davem@davemloft.net, edumazet@google.com, netdev@vger.kernel.org, + linux-kernel@vger.kernel.org +Original-X-From: linux-kernel-owner@vger.kernel.org Fri Nov 01 08:01:39 2013 +Return-path: <linux-kernel-owner@vger.kernel.org> +Envelope-to: glk-linux-kernel-3@plane.gmane.org +Original-Received: from vger.kernel.org ([209.132.180.67]) + by plane.gmane.org with esmtp (Exim 4.69) + (envelope-from <linux-kernel-owner@vger.kernel.org>) + id 1Vc8jh-00034h-9Y + for glk-linux-kernel-3@plane.gmane.org; Fri, 01 Nov 2013 08:01:37 +0100 +Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand + id S1753899Ab3KAHB3 (ORCPT <rfc822;glk-linux-kernel-3@m.gmane.org>); + Fri, 1 Nov 2013 03:01:29 -0400 +Original-Received: from mx1.redhat.com ([209.132.183.28]:8081 "EHLO mx1.redhat.com" + rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP + id S1752399Ab3KAHB1 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); + Fri, 1 Nov 2013 03:01:27 -0400 +Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) + by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rA171QgE005079 + (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); + Fri, 1 Nov 2013 03:01:26 -0400 +Original-Received: from jason-ThinkPad-T430s.nay.redhat.com (dhcp-66-71-71.eng.nay.redhat.com [10.66.71.71] (may be forged)) + by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id rA171Jpr015790; + Fri, 1 Nov 2013 03:01:20 -0400 +X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 +Original-Sender: linux-kernel-owner@vger.kernel.org +Precedence: bulk +List-ID: <linux-kernel.vger.kernel.org> +X-Mailing-List: linux-kernel@vger.kernel.org +Xref: news.gmane.org gmane.linux.kernel:1588387 gmane.linux.network:289242 +Archived-At: <http://permalink.gmane.org/gmane.linux.kernel/1588387> + +We don't validate iph->ihl which may lead a dead loop if we meet a IPIP +skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl +is evil (less than 5). + +This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae +(rps: support IPIP encapsulation). + +Cc: Eric Dumazet <edumazet@google.com> +Cc: Petr Matousek <pmatouse@redhat.com> +Cc: Michael S. Tsirkin <mst@redhat.com> +Cc: Daniel Borkmann <dborkman@redhat.com> +Signed-off-by: Jason Wang <jasowang@redhat.com> +--- +This patch is needed for stable. +--- + net/core/flow_dissector.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 8d7d0dd..143b6fd 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -40,7 +40,7 @@ again: + struct iphdr _iph; + ip: + iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph); +- if (!iph) ++ if (!iph || iph->ihl < 5) + return false; + + if (ip_is_fragment(iph)) +-- +1.8.1.2 + |