Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity
android_kernel_samsung_msm8976/net
History
Eric Biggers f6666d3858 af_key: fix buffer overread in parse_exthdrs() 
commit 4e765b4972af7b07adcb1feb16e7a525ce1f6b28 upstream.

If a message sent to a PF_KEY socket ended with an incomplete extension
header (fewer than 4 bytes remaining), then parse_exthdrs() read past
the end of the message, into uninitialized memory.  Fix it by returning
-EINVAL in this case.

Reproducer:

	#include <linux/pfkeyv2.h>
	#include <sys/socket.h>
	#include <unistd.h>

	int main()
	{
		int sock = socket(PF_KEY, SOCK_RAW, PF_KEY_V2);
		char buf[17] = { 0 };
		struct sadb_msg *msg = (void *)buf;

		msg->sadb_msg_version = PF_KEY_V2;
		msg->sadb_msg_type = SADB_DELETE;
		msg->sadb_msg_len = 2;

		write(sock, buf, 17);
	}

Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
 		2019-07-27 21:46:23 +02:00
..
9p 9p: forgetting to cancel request on interrupted zero-copy RPC 2015-08-03 09:29:47 -07:00
802
…
8021q
…
appletalk
…
atm
…
ax25 Import latest Samsung release 2017-04-18 03:43:52 +02:00
batman-adv batman-adv: Fix broadcast/ogm queue limit on a removed interface 2016-06-07 10:42:53 +02:00
bluetooth Bluetooth: Prevent stack info leak from the EFS element. 2019-07-27 21:45:54 +02:00
bridge Revert "netfilter: ensure number of counters is >0 in do_replace()" 2019-07-27 21:41:44 +02:00
caif net/unix: sk_socket can disappear when state is unlocked 2015-09-16 18:20:18 +05:30
can
…
ceph libceph: introduce ceph_crypt() for in-place en/decryption 2017-04-22 23:02:50 +02:00
core net: avoid skb_warn_bad_offload on IS_ERR 2019-07-27 21:46:09 +02:00
dcb
…
dccp dccp: CVE-2017-8824: use-after-free in DCCP code 2019-07-27 21:45:45 +02:00
decnet Import latest Samsung release 2017-04-18 03:43:52 +02:00
dns_resolver
…
dsa
…
ethernet
…
ieee802154
…
ipc_router net: ipc_router: Remove duplicate client port check 2017-04-22 23:02:47 +02:00
ipv4 xfrm: Reinject transport-mode packets through tasklet 2019-07-27 21:46:20 +02:00
ipv6 xfrm: Reinject transport-mode packets through tasklet 2019-07-27 21:46:20 +02:00
ipx ipx: call ipxitf_put() in ioctl error path 2018-01-21 21:05:49 -08:00
irda irda: Fix lockdep annotations in hashbin_delete(). 2017-04-22 23:02:49 +02:00
iucv
…
key af_key: fix buffer overread in parse_exthdrs() 2019-07-27 21:46:23 +02:00
l2tp l2tp: initialise PPP sessions before registering them 2019-07-27 21:46:03 +02:00
lapb
…
llc net/llc: avoid BUG_ON() in skb_orphan() 2017-04-22 23:03:00 +02:00
mac80211 mac80211: use constant time comparison with keys 2019-07-27 21:45:47 +02:00
mac802154
…
netfilter netfilter: xt_TCPMSS: correct return value in tcpmss_mangle_packet 2019-07-27 21:46:06 +02:00
netlabel netlabel: add address family checks to netlbl_{sock,req}_delattr() 2019-07-27 21:41:59 +02:00
netlink netlink: Fix dump skb leak/double free 2017-04-22 23:02:56 +02:00
netrom
…
nfc
…
openvswitch
…
packet packet: only test po->has_vnet_hdr once in packet_snd 2019-07-27 21:45:34 +02:00
phonet This is the 3.10.96 stable release 2017-04-18 17:16:02 +02:00
rds This is the 3.10.99 stable release 2017-04-18 17:17:46 +02:00
rfkill net: rfkill: Do not ignore errors from regulator_enable() 2019-07-27 21:42:01 +02:00
rmnet_data net: rmnet_data: Add support to configure custom device name 2018-09-05 18:14:57 +02:00
rose
…
rxrpc rxrpc: Fix several cases where a padded len isn't checked in ticket decode 2019-07-27 21:44:13 +02:00
sched sch_fq_codel: avoid double free on init failure 2019-07-27 21:45:13 +02:00
sctp sctp: fix a type cast warnings that causes a_rwnd gets the wrong value 2019-07-27 21:45:39 +02:00
sunrpc kernel: make groups_sort calling a responsibility group_info allocators 2019-07-27 21:46:18 +02:00
tipc net/tipc: initialize security state for new connection socket 2015-10-01 12:07:35 +02:00
unix net/unix: don't show information about sockets from other namespaces 2019-07-27 21:45:50 +02:00
vmw_vsock VSOCK: do not disconnect socket when peer has shutdown SEND only 2016-06-07 10:42:54 +02:00
wimax
…
wireless cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES 2019-07-27 21:44:37 +02:00
x25 net: fix a kernel infoleak in x25 module 2016-06-07 10:42:54 +02:00
xfrm xfrm: Reinject transport-mode packets through tasklet 2019-07-27 21:46:20 +02:00
Kconfig
…
Makefile
…
activity_stats.c
…
compat.c
…
nonet.c
…
socket.c net: socket: fix recvmmsg not returning error from sock_error 2019-07-27 21:43:06 +02:00
sysctl_net.c
…