[prev in list] [next in list] [prev in thread] [next in thread]
List: ipfire-scm
Subject: [git.ipfire.org] IPFire 2.x development tree branch, next, updated. 1d15fbd440308b7bf64dcc0944f1ca26
From: Arne Fitzenreiter <git () ipfire ! org>
Date: 2020-09-11 19:32:05
Message-ID: 4Bp5VY3Tp0z2xdJ () people01 ! haj ! ipfire ! org
[Download RAW message or body]
This is an automated email from the git hooks/post-receive script. It was
generated because a ref change was pushed to the repository containing
the project "IPFire 2.x development tree".
The branch, next has been updated
via 1d15fbd440308b7bf64dcc0944f1ca26589a4b56 (commit)
via f04023b1ca5675ce5463ca47186462179fd7a02a (commit)
from 10d0489df2eb32f9c8fd8d6fb0db00e99bfaab02 (commit)
Those revisions listed above that are new to this repository have
not appeared on any other notification email; so we list those
revisions in full, below.
- Log -----------------------------------------------------------------
commit 1d15fbd440308b7bf64dcc0944f1ca26589a4b56
Author: Arne Fitzenreiter <arne_f@ipfire.org>
Date: Fri Sep 11 21:30:15 2020 +0200
kernel: cleanup kirkwood patch apply lines
kirkwood support is removed long time ago and the patch already
removed from tree.
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
commit f04023b1ca5675ce5463ca47186462179fd7a02a
Author: Arne Fitzenreiter <arne_f@ipfire.org>
Date: Fri Sep 11 21:27:15 2020 +0200
kernel: add patch against CVE-2020-14386
fixes #12483
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>
-----------------------------------------------------------------------
Summary of changes:
lfs/linux | 5 +-
...86_net_packet_fix_overflow_in_tpacket_rcv.patch | 54 ++++++++++++++++++++++
2 files changed, 56 insertions(+), 3 deletions(-)
create mode 100644 src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch
Difference in files:
diff --git a/lfs/linux b/lfs/linux
index 248257286..57f355e74 100644
--- a/lfs/linux
+++ b/lfs/linux
@@ -144,9 +144,8 @@ $(TARGET) : $(patsubst %,$(DIR_DL)/%,$(objects))
cd $(DIR_APP) && patch -Np1 < \
$(DIR_SRC)/src/patches/linux/linux-random_try_to_actively_add_entropy.patch cd \
$(DIR_APP) && patch -Np1 < \
$(DIR_SRC)/src/patches/linux/linux-4.14.x-add_timer_setup_on_stack.patch
-ifeq "$(KCFG)" "-kirkwood"
- cd $(DIR_APP) && patch -Np1 < \
$(DIR_SRC)/src/patches/linux/linux-4.14.40-kirkwood-dtb.patch
-endif
+ # Patch CVE-2020-14386
+ cd $(DIR_APP) && patch -Np1 < \
$(DIR_SRC)/src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch
ifeq "$(KCFG)" "-multi"
# Apply Arm-multiarch kernel patches.
diff --git a/src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch \
b/src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch \
new file mode 100644 index 000000000..439dca7ac
--- /dev/null
+++ b/src/patches/linux/linux-cve-2020-14386_net_packet_fix_overflow_in_tpacket_rcv.patch
@@ -0,0 +1,54 @@
+From acf69c946233259ab4d64f8869d4037a198c7f06 Mon Sep 17 00:00:00 2001
+From: Or Cohen <orcohen@paloaltonetworks.com>
+Date: Thu, 3 Sep 2020 21:05:28 -0700
+Subject: net/packet: fix overflow in tpacket_rcv
+
+Using tp_reserve to calculate netoff can overflow as
+tp_reserve is unsigned int and netoff is unsigned short.
+
+This may lead to macoff receving a smaller value then
+sizeof(struct virtio_net_hdr), and if po->has_vnet_hdr
+is set, an out-of-bounds write will occur when
+calling virtio_net_hdr_from_skb.
+
+The bug is fixed by converting netoff to unsigned int
+and checking if it exceeds USHRT_MAX.
+
+This addresses CVE-2020-14386
+
+Fixes: 8913336a7e8d ("packet: add PACKET_RESERVE sockopt")
+Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+---
+ net/packet/af_packet.c | 7 ++++++-
+ 1 file changed, 6 insertions(+), 1 deletion(-)
+
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index da8254e680f94..2b33e977a9059 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2170,7 +2170,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device \
*dev, + int skb_len = skb->len;
+ unsigned int snaplen, res;
+ unsigned long status = TP_STATUS_USER;
+- unsigned short macoff, netoff, hdrlen;
++ unsigned short macoff, hdrlen;
++ unsigned int netoff;
+ struct sk_buff *copy_skb = NULL;
+ struct timespec64 ts;
+ __u32 ts_status;
+@@ -2239,6 +2240,10 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device \
*dev, + }
+ macoff = netoff - maclen;
+ }
++ if (netoff > USHRT_MAX) {
++ atomic_inc(&po->tp_drops);
++ goto drop_n_restore;
++ }
+ if (po->tp_version <= TPACKET_V2) {
+ if (macoff + snaplen > po->rx_ring.frame_size) {
+ if (po->copy_thresh &&
+--
+cgit 1.2.3-1.el7
+
hooks/post-receive
--
IPFire 2.x development tree
_______________________________________________
IPFire-SCM mailing list
IPFire-SCM@lists.ipfire.org
https://lists.ipfire.org/mailman/listinfo/ipfire-scm
[prev in list] [next in list] [prev in thread] [next in thread]
Configure |
About |
News |
Add a list |
Sponsored by KoreLogic