diff options
| author | Natanael Copa <ncopa@alpinelinux.org> | 2013-11-14 10:24:45 +0000 |
|---|---|---|
| committer | Natanael Copa <ncopa@alpinelinux.org> | 2013-11-14 10:27:00 +0000 |
| commit | 073d94a37924574226a80ce08ed55a5bce6af6dd (patch) | |
| tree | 054af9f7fdee599836881b58f5f8dc27ea586516 /main/linux-vserver/CVE-2013-4348.patch | |
| parent | d8fa59f0ddf835f8d9c7c0b2b45a1a626c8898c6 (diff) | |
| download | aports-073d94a37924574226a80ce08ed55a5bce6af6dd.tar.bz2 aports-073d94a37924574226a80ce08ed55a5bce6af6dd.tar.xz | |
main/linux-vserver: upgrade to 3.10.19 and fix CVE-2013-4348
Diffstat (limited to 'main/linux-vserver/CVE-2013-4348.patch')
| -rw-r--r-- | main/linux-vserver/CVE-2013-4348.patch | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/main/linux-vserver/CVE-2013-4348.patch b/main/linux-vserver/CVE-2013-4348.patch new file mode 100644 index 0000000000..cce1592eb8 --- /dev/null +++ b/main/linux-vserver/CVE-2013-4348.patch @@ -0,0 +1,35 @@ +From 6f092343855a71e03b8d209815d8c45bf3a27fcd Mon Sep 17 00:00:00 2001 +From: Jason Wang <jasowang@redhat.com> +Date: Fri, 01 Nov 2013 07:01:10 +0000 +Subject: net: flow_dissector: fail on evil iph->ihl + +We don't validate iph->ihl which may lead a dead loop if we meet a IPIP +skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl +is evil (less than 5). + +This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae +(rps: support IPIP encapsulation). + +Cc: Eric Dumazet <edumazet@google.com> +Cc: Petr Matousek <pmatouse@redhat.com> +Cc: Michael S. Tsirkin <mst@redhat.com> +Cc: Daniel Borkmann <dborkman@redhat.com> +Signed-off-by: Jason Wang <jasowang@redhat.com> +Acked-by: Eric Dumazet <edumazet@google.com> +Signed-off-by: David S. Miller <davem@davemloft.net> +--- +diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c +index 8d7d0dd..143b6fd 100644 +--- a/net/core/flow_dissector.c ++++ b/net/core/flow_dissector.c +@@ -40,7 +40,7 @@ again: + struct iphdr _iph; + ip: + iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph); +- if (!iph) ++ if (!iph || iph->ihl < 5) + return false; + + if (ip_is_fragment(iph)) +-- +cgit v0.9.2 |