summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMark J Cox <mjc@redhat.com>2005-09-20 00:55:30 (GMT)
committerLinus Torvalds <torvalds@g5.osdl.org>2005-09-20 01:45:42 (GMT)
commit6d1cfe3f1752f17e297df60c8bcc6cd6e0a58449 (patch)
tree458323fe234aef3e5b96abf153feec48fe8a84df
parent997a51ae373df6484cdd4a5fc61a9c9bec82cd68 (diff)
downloadlinux-3.10-6d1cfe3f1752f17e297df60c8bcc6cd6e0a58449.zip
linux-3.10-6d1cfe3f1752f17e297df60c8bcc6cd6e0a58449.tar.gz
linux-3.10-6d1cfe3f1752f17e297df60c8bcc6cd6e0a58449.tar.bz2
[PATCH] raw_sendmsg DoS on 2.6
Fix unchecked __get_user that could be tricked into generating a memory read on an arbitrary address. The result of the read is not returned directly but you may be able to divine some information about it, or use the read to cause a crash on some architectures by reading hardware state. CAN-2004-2492. Fix from Al Viro, ack from Dave Miller. Signed-off-by: Linus Torvalds <torvalds@osdl.org>
-rw-r--r--net/ipv4/raw.c2
-rw-r--r--net/ipv6/raw.c2
2 files changed, 2 insertions, 2 deletions
diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 304bb0a..4b0d7e4 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -361,7 +361,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
if (type && code) {
get_user(fl->fl_icmp_type, type);
- __get_user(fl->fl_icmp_code, code);
+ get_user(fl->fl_icmp_code, code);
probed = 1;
}
break;
diff --git a/net/ipv6/raw.c b/net/ipv6/raw.c
index 5aa3691..a1265a3 100644
--- a/net/ipv6/raw.c
+++ b/net/ipv6/raw.c
@@ -627,7 +627,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
if (type && code) {
get_user(fl->fl_icmp_type, type);
- __get_user(fl->fl_icmp_code, code);
+ get_user(fl->fl_icmp_code, code);
probed = 1;
}
break;