a70918fbbc
rebase on Ubuntu-4.13.0-32.35 the effective kernel tree which gets compiled after patches have been applied is functionally identical (modulo parts for architectures which we don't care about and Ubuntu build files)
54 lines
1.8 KiB
Diff
54 lines
1.8 KiB
Diff
From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001
|
|
From: Mohamed Ghannam <simo.ghannam@gmail.com>
|
|
Date: Fri, 8 Dec 2017 15:39:50 +0100
|
|
Subject: [PATCH] dccp: CVE-2017-8824: use-after-free in DCCP code
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Whenever the sock object is in DCCP_CLOSED state,
|
|
dccp_disconnect() must free dccps_hc_tx_ccid and
|
|
dccps_hc_rx_ccid and set to NULL.
|
|
|
|
Signed-off-by: Mohamed Ghannam <simo.ghannam@gmail.com>
|
|
Reviewed-by: Eric Dumazet <edumazet@google.com>
|
|
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
|
CVE-2017-8824
|
|
(cherry picked from commit 69c64866ce072dea1d1e59a0d61e0f66c0dffb76 linux-next)
|
|
Signed-off-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>
|
|
Acked-by: Seth Forshee <seth.forshee@canonical.com>
|
|
Acked-by: Colin Ian King <colin.king@canonical.com>
|
|
Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@canonical.com>
|
|
Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com>
|
|
---
|
|
net/dccp/proto.c | 5 +++++
|
|
1 file changed, 5 insertions(+)
|
|
|
|
diff --git a/net/dccp/proto.c b/net/dccp/proto.c
|
|
index b68168fcc06a..9d43c1f40274 100644
|
|
--- a/net/dccp/proto.c
|
|
+++ b/net/dccp/proto.c
|
|
@@ -259,6 +259,7 @@ int dccp_disconnect(struct sock *sk, int flags)
|
|
{
|
|
struct inet_connection_sock *icsk = inet_csk(sk);
|
|
struct inet_sock *inet = inet_sk(sk);
|
|
+ struct dccp_sock *dp = dccp_sk(sk);
|
|
int err = 0;
|
|
const int old_state = sk->sk_state;
|
|
|
|
@@ -278,6 +279,10 @@ int dccp_disconnect(struct sock *sk, int flags)
|
|
sk->sk_err = ECONNRESET;
|
|
|
|
dccp_clear_xmit_timers(sk);
|
|
+ ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
|
|
+ ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
|
|
+ dp->dccps_hc_rx_ccid = NULL;
|
|
+ dp->dccps_hc_tx_ccid = NULL;
|
|
|
|
__skb_queue_purge(&sk->sk_receive_queue);
|
|
__skb_queue_purge(&sk->sk_write_queue);
|
|
--
|
|
2.14.2
|
|
|