[kernel/f20] CVE-2013-4348 net: deadloop path in skb_flow_dissect (rhbz 1007939 1025647)
Josh Boyer
jwboyer at fedoraproject.org
Fri Nov 1 12:30:43 UTC 2013
commit 347bd0b7c7a55ecaccf1c838feef7652787424db
Author: Josh Boyer <jwboyer at fedoraproject.org>
Date: Fri Nov 1 08:23:10 2013 -0400
CVE-2013-4348 net: deadloop path in skb_flow_dissect (rhbz 1007939 1025647)
PatchList.txt | 3 +
kernel.spec | 9 +++
net-flow_dissector-fail-on-evil-iph-ihl.patch | 82 +++++++++++++++++++++++++
3 files changed, 94 insertions(+), 0 deletions(-)
---
diff --git a/PatchList.txt b/PatchList.txt
index c255046..0bdf823 100644
--- a/PatchList.txt
+++ b/PatchList.txt
@@ -1,5 +1,8 @@
**** Backports and patches headed/already upstream *****************************
+* net-flow_dissector-fail-on-evil-iph-ihl.patch (rhbz 1007939 1025647)
+ - Should hit upstream and stable soon
+
* intel-3.12-stable-fixes.patch (rhbz 995782)
- Backport of upstream commits:
4f56d12ebb28fceac4c6e60c8993fbfc122e1399
diff --git a/kernel.spec b/kernel.spec
index 9185a92..6f4c8ba 100644
--- a/kernel.spec
+++ b/kernel.spec
@@ -803,6 +803,9 @@ Patch25137: cifs-Allow-LANMAN-auth-for-unencapsulated-auth-methods.patch
#rhbz 995782
Patch25138: intel-3.12-stable-fixes.patch
+#CVE-2013-4348 rhbz 1007939 1025647
+Patch25139: net-flow_dissector-fail-on-evil-iph-ihl.patch
+
# END OF PATCH DEFINITIONS
%endif
@@ -1564,6 +1567,9 @@ ApplyPatch cifs-Allow-LANMAN-auth-for-unencapsulated-auth-methods.patch
#rhbz 995782
ApplyPatch intel-3.12-stable-fixes.patch
+#CVE-2013-4348 rhbz 1007939 1025647
+ApplyPatch net-flow_dissector-fail-on-evil-iph-ihl.patch
+
# END OF PATCH APPLICATIONS
%endif
@@ -2366,6 +2372,9 @@ fi
# ||----w |
# || ||
%changelog
+* Fri Nov 01 2013 Josh Boyer <jwboyer at fedoraproject.org>
+- CVE-2013-4348 net: deadloop path in skb_flow_dissect (rhbz 1007939 1025647)
+
* Thu Oct 31 2013 Josh Boyer <jwboyer at fedoraprorject.org>
- Fix display regression on Dell XPS 13 machines (rhbz 995782)
diff --git a/net-flow_dissector-fail-on-evil-iph-ihl.patch b/net-flow_dissector-fail-on-evil-iph-ihl.patch
new file mode 100644
index 0000000..aba3ea8
--- /dev/null
+++ b/net-flow_dissector-fail-on-evil-iph-ihl.patch
@@ -0,0 +1,82 @@
+Path: news.gmane.org!not-for-mail
+From: Jason Wang <jasowang at redhat.com>
+Newsgroups: gmane.linux.kernel,gmane.linux.network
+Subject: [PATCH net] net: flow_dissector: fail on evil iph->ihl
+Date: Fri, 1 Nov 2013 15:01:10 +0800
+Lines: 34
+Approved: news at gmane.org
+Message-ID: <1383289270-18952-1-git-send-email-jasowang at redhat.com>
+NNTP-Posting-Host: plane.gmane.org
+X-Trace: ger.gmane.org 1383289296 18578 80.91.229.3 (1 Nov 2013 07:01:36 GMT)
+X-Complaints-To: usenet at ger.gmane.org
+NNTP-Posting-Date: Fri, 1 Nov 2013 07:01:36 +0000 (UTC)
+Cc: Jason Wang <jasowang at redhat.com>,
+ Petr Matousek <pmatouse at redhat.com>,
+ "Michael S. Tsirkin" <mst at redhat.com>,
+ Daniel Borkmann <dborkman at redhat.com>
+To: davem at davemloft.net, edumazet at google.com, netdev at vger.kernel.org,
+ linux-kernel at vger.kernel.org
+Original-X-From: linux-kernel-owner at vger.kernel.org Fri Nov 01 08:01:39 2013
+Return-path: <linux-kernel-owner at vger.kernel.org>
+Envelope-to: glk-linux-kernel-3 at plane.gmane.org
+Original-Received: from vger.kernel.org ([209.132.180.67])
+ by plane.gmane.org with esmtp (Exim 4.69)
+ (envelope-from <linux-kernel-owner at vger.kernel.org>)
+ id 1Vc8jh-00034h-9Y
+ for glk-linux-kernel-3 at plane.gmane.org; Fri, 01 Nov 2013 08:01:37 +0100
+Original-Received: (majordomo at vger.kernel.org) by vger.kernel.org via listexpand
+ id S1753899Ab3KAHB3 (ORCPT <rfc822;glk-linux-kernel-3 at m.gmane.org>);
+ Fri, 1 Nov 2013 03:01:29 -0400
+Original-Received: from mx1.redhat.com ([209.132.183.28]:8081 "EHLO mx1.redhat.com"
+ rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
+ id S1752399Ab3KAHB1 (ORCPT <rfc822;linux-kernel at vger.kernel.org>);
+ Fri, 1 Nov 2013 03:01:27 -0400
+Original-Received: from int-mx02.intmail.prod.int.phx2.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12])
+ by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rA171QgE005079
+ (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=OK);
+ Fri, 1 Nov 2013 03:01:26 -0400
+Original-Received: from jason-ThinkPad-T430s.nay.redhat.com (dhcp-66-71-71.eng.nay.redhat.com [10.66.71.71] (may be forged))
+ by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id rA171Jpr015790;
+ Fri, 1 Nov 2013 03:01:20 -0400
+X-Scanned-By: MIMEDefang 2.67 on 10.5.11.12
+Original-Sender: linux-kernel-owner at vger.kernel.org
+Precedence: bulk
+List-ID: <linux-kernel.vger.kernel.org>
+X-Mailing-List: linux-kernel at vger.kernel.org
+Xref: news.gmane.org gmane.linux.kernel:1588387 gmane.linux.network:289242
+Archived-At: <http://permalink.gmane.org/gmane.linux.kernel/1588387>
+
+We don't validate iph->ihl which may lead a dead loop if we meet a IPIP
+skb whose iph->ihl is zero. Fix this by failing immediately when iph->ihl
+is evil (less than 5).
+
+This issue were introduced by commit ec5efe7946280d1e84603389a1030ccec0a767ae
+(rps: support IPIP encapsulation).
+
+Cc: Eric Dumazet <edumazet at google.com>
+Cc: Petr Matousek <pmatouse at redhat.com>
+Cc: Michael S. Tsirkin <mst at redhat.com>
+Cc: Daniel Borkmann <dborkman at redhat.com>
+Signed-off-by: Jason Wang <jasowang at redhat.com>
+---
+This patch is needed for stable.
+---
+ net/core/flow_dissector.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
+index 8d7d0dd..143b6fd 100644
+--- a/net/core/flow_dissector.c
++++ b/net/core/flow_dissector.c
+@@ -40,7 +40,7 @@ again:
+ struct iphdr _iph;
+ ip:
+ iph = skb_header_pointer(skb, nhoff, sizeof(_iph), &_iph);
+- if (!iph)
++ if (!iph || iph->ihl < 5)
+ return false;
+
+ if (ip_is_fragment(iph))
+--
+1.8.1.2
+
More information about the scm-commits
mailing list