mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-27 04:47:05 +00:00
[PATCH] raw_sendmsg DoS (CAN-2005-2492)
Fix unchecked __get_user that could be tricked into generating a memory read on an arbitrary address. The result of the read is not returned directly but you may be able to divine some information about it, or use the read to cause a crash on some architectures by reading hardware state. CAN-2005-2492. Fix from Al Viro, ack from Dave Miller. Signed-off-by: Chris Wright <chrisw@osdl.org> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
parent
c255cda2af
commit
0721a681c6
2 changed files with 2 additions and 2 deletions
|
@ -358,7 +358,7 @@ static void raw_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
|
|||
|
||||
if (type && code) {
|
||||
get_user(fl->fl_icmp_type, type);
|
||||
__get_user(fl->fl_icmp_code, code);
|
||||
get_user(fl->fl_icmp_code, code);
|
||||
probed = 1;
|
||||
}
|
||||
break;
|
||||
|
|
|
@ -619,7 +619,7 @@ static void rawv6_probe_proto_opt(struct flowi *fl, struct msghdr *msg)
|
|||
|
||||
if (type && code) {
|
||||
get_user(fl->fl_icmp_type, type);
|
||||
__get_user(fl->fl_icmp_code, code);
|
||||
get_user(fl->fl_icmp_code, code);
|
||||
probed = 1;
|
||||
}
|
||||
break;
|
||||
|
|
Loading…
Reference in a new issue