diff options
| -rw-r--r-- | kernel.spec | 11 | ||||
| -rw-r--r-- | net-flow_dissector-fail-on-evil-iph-ihl.patch | 82 | ||||
| -rw-r--r-- | sources | 1 |
3 files changed, 5 insertions, 89 deletions
diff --git a/kernel.spec b/kernel.spec index 3adb447c2..815434e21 100644 --- a/kernel.spec +++ b/kernel.spec @@ -74,7 +74,7 @@ Summary: The Linux kernel %if 0%{?released_kernel} # Do we have a -stable update to apply? -%define stable_update 0 +%define stable_update 1 # Is it a -stable RC? %define stable_rc 0 # Set rpm version accordingly @@ -735,9 +735,6 @@ Patch25131: btrfs-relocate-csums-properly-with-prealloc-ext.patch #rhbz 984696 Patch25132: rt2800usb-slow-down-TX-status-polling.patch -#CVE-2013-4348 rhbz 1007939 1025647 -Patch25139: net-flow_dissector-fail-on-evil-iph-ihl.patch - Patch25140: drm-qxl-backport-fixes-for-Fedora.patch Patch25141: Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch @@ -1461,9 +1458,6 @@ ApplyPatch btrfs-relocate-csums-properly-with-prealloc-ext.patch #rhbz 984696 ApplyPatch rt2800usb-slow-down-TX-status-polling.patch -#CVE-2013-4348 rhbz 1007939 1025647 -ApplyPatch net-flow_dissector-fail-on-evil-iph-ihl.patch - ApplyPatch drm-qxl-backport-fixes-for-Fedora.patch ApplyPatch Input-evdev-fall-back-to-vmalloc-for-client-event-buffer.patch @@ -2287,6 +2281,9 @@ fi # ||----w | # || || %changelog +* Wed Nov 20 2013 Josh Boyer <jwboyer@fedoraproject.org> +- Linux v3.12.1 + * Tue Nov 19 2013 Josh Boyer <jwboyer@fedoraproject.org> - Enable CGROUP_HUGETLB on ppc64/ppc64p7 and x86_64 (rhbz 1031984) diff --git a/net-flow_dissector-fail-on-evil-iph-ihl.patch b/net-flow_dissector-fail-on-evil-iph-ihl.patch deleted file mode 100644 index aba3ea88b..000000000 --- a/net-flow_dissector-fail-on-evil-iph-ihl.patch +++ /dev/null @@ -1,82 +0,0 @@ -Path: news.gmane.org!not-for-mail -From: Jason Wang <jasowang@redhat.com> -Newsgroups: gmane.linux.kernel,gmane.linux.network -Subject: [PATCH net] net: flow_dissector: fail on evil iph->ihl -Date: Fri, 1 Nov 2013 15:01:10 +0800 -Lines: 34 -Approved: news@gmane.org -Message-ID: <1383289270-18952-1-git-send-email-jasowang@redhat.com> -NNTP-Posting-Host: plane.gmane.org -X-Trace: ger.gmane.org 1383289296 18578 80.91.229.3 (1 Nov 2013 07:01:36 GMT) -X-Complaints-To: usenet@ger.gmane.org -NNTP-Posting-Date: Fri, 1 Nov 2013 07:01:36 +0000 (UTC) -Cc: Jason Wang <jasowang@redhat.com>, - Petr Matousek <pmatouse@redhat.com>, - "Michael S. Tsirkin" <mst@redhat.com>, - Daniel Borkmann <dborkman@redhat.com> -To: davem@davemloft.net, edumazet@google.com, netdev@vger.kernel.org, - linux-kernel@vger.kernel.org -Original-X-From: linux-kernel-owner@vger.kernel.org Fri Nov 01 08:01:39 2013 -Return-path: <linux-kernel-owner@vger.kernel.org> -Envelope-to: glk-linux-kernel-3@plane.gmane.org -Original-Received: from vger.kernel.org ([209.132.180.67]) - by plane.gmane.org with esmtp (Exim 4.69) - (envelope-from <linux-kernel-owner@vger.kernel.org>) - id 1Vc8jh-00034h-9Y - for glk-linux-kernel-3@plane.gmane.org; Fri, 01 Nov 2013 08:01:37 +0100 -Original-Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand - id S1753899Ab3KAHB3 (ORCPT <rfc822;glk-linux-kernel-3@m.gmane.org>); - Fri, 1 Nov 2013 03:01:29 -0400 -Original-Received: from mx1.redhat.com ([209.132.183.28]:8081 "EHLO mx1.redhat.com" - rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP - id S1752399Ab3KAHB1 (ORCPT <rfc822;linux-kernel@vger.kernel.org>); - Fri, 1 Nov 2013 03:01:27 -0400 -Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) - by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rA171QgE005079 - (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK); - Fri, 1 Nov 2013 03:01:26 -0400 -Original-Received: from jason-ThinkPad-T430s.nay.redhat.com (dhcp-66-71-71.eng.nay.redhat.com [10.66.71.71] (may be forged)) - by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id rA171Jpr015790; - Fri, 1 Nov 2013 03:01:20 -0400 -X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12 -Original-Sender: linux-kernel-owner@vger.kernel.org -Precedence: bulk -List-ID: <linux-kernel.vger.kernel.org> -X-Mailing-List: linux-kernel@vger.kernel.org -Xref: news.gmane.org gmane.linux.kernel:1588387 gmane.linux.network:289242 -Archived-At: <http://permalink.gmane.org/gmane.linux.kernel/1588387> - -We don't validate iph->ihl which may lead a dead loop if we meet a IPIP -skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl -is evil (less than 5). - -This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae -(rps: support IPIP encapsulation). - -Cc: Eric Dumazet <edumazet@google.com> -Cc: Petr Matousek <pmatouse@redhat.com> -Cc: Michael S. Tsirkin <mst@redhat.com> -Cc: Daniel Borkmann <dborkman@redhat.com> -Signed-off-by: Jason Wang <jasowang@redhat.com> ---- -This patch is needed for stable. ---- - net/core/flow_dissector.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - -diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c -index 8d7d0dd..143b6fd 100644 ---- a/net/core/flow_dissector.c -+++ b/net/core/flow_dissector.c -@@ -40,7 +40,7 @@ again: - struct iphdr _iph; - ip: - iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph); -- if (!iph) -+ if (!iph || iph->ihl < 5) - return false; - - if (ip_is_fragment(iph)) --- -1.8.1.2 - @@ -1 +1,2 @@ cc6ee608854e0da4b64f6c1ff8b6398c linux-3.12.tar.xz +5a8cb5a659baeeb6df3fe22de8d32df6 patch-3.12.1.xz |