diff options
| author | Michal Kubeček <mkubecek@suse.cz> | 2016-07-08 17:52:33 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2016-07-11 21:43:15 +0200 |
| commit | a612769774a30e4fc143c4cb6395c12573415660 (patch) | |
| tree | 6d8340d073fd7465158f130e1bbe23429956f3b0 /Documentation/development-process | |
| parent | bnxt_en: initialize rc to zero to avoid returning garbage (diff) | |
| download | linux-a612769774a30e4fc143c4cb6395c12573415660.tar.xz linux-a612769774a30e4fc143c4cb6395c12573415660.zip | |
udp: prevent bugcheck if filter truncates packet too much
If socket filter truncates an udp packet below the length of UDP header
in udpv6_queue_rcv_skb() or udp_queue_rcv_skb(), it will trigger a
BUG_ON in skb_pull_rcsum(). This BUG_ON (and therefore a system crash if
kernel is configured that way) can be easily enforced by an unprivileged
user which was reported as CVE-2016-6162. For a reproducer, see
http://seclists.org/oss-sec/2016/q3/8
Fixes: e6afc8ace6dd ("udp: remove headers from UDP packets before queueing")
Reported-by: Marco Grassi <marco.gra@gmail.com>
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'Documentation/development-process')
0 files changed, 0 insertions, 0 deletions