| From stable-bounces@linux.kernel.org Thu Mar 29 11:59:00 2007 |
| From: David Miller <davem@davemloft.net> |
| Date: Thu, 29 Mar 2007 11:57:36 -0700 (PDT) |
| Subject: DCCP: Fix exploitable hole in DCCP socket options |
| To: stable@kernel.org |
| Cc: bunk@stusta.de |
| Message-ID: <20070329.115736.39158322.davem@davemloft.net> |
| |
| |
| From: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> |
| |
| [DCCP] getsockopt: Fix DCCP_SOCKOPT_[SEND,RECV]_CSCOV |
| |
| We were only checking if there was enough space to put the int, but |
| left len as specified by the (malicious) user, sigh, fix it by setting |
| len to sizeof(val) and transfering just one int worth of data, the one |
| asked for. |
| |
| Also check for negative len values. |
| |
| Signed-off-by: Arnaldo Carvalho de Melo <acme@ghostprotocols.net> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/dccp/proto.c | 4 +++- |
| 1 file changed, 3 insertions(+), 1 deletion(-) |
| |
| --- a/net/dccp/proto.c |
| +++ b/net/dccp/proto.c |
| @@ -575,7 +575,7 @@ static int do_dccp_getsockopt(struct soc |
| if (get_user(len, optlen)) |
| return -EFAULT; |
| |
| - if (len < sizeof(int)) |
| + if (len < (int)sizeof(int)) |
| return -EINVAL; |
| |
| dp = dccp_sk(sk); |
| @@ -589,9 +589,11 @@ static int do_dccp_getsockopt(struct soc |
| (__be32 __user *)optval, optlen); |
| case DCCP_SOCKOPT_SEND_CSCOV: |
| val = dp->dccps_pcslen; |
| + len = sizeof(val); |
| break; |
| case DCCP_SOCKOPT_RECV_CSCOV: |
| val = dp->dccps_pcrlen; |
| + len = sizeof(val); |
| break; |
| case 128 ... 191: |
| return ccid_hc_rx_getsockopt(dp->dccps_hc_rx_ccid, sk, optname, |
