mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-08-27 19:29:37 +00:00
Code Issues Releases Wiki Activity
linux-stable/net
History
Xin Long a7112b8eeb sctp: add vtag check in sctp_sf_ootb 
[ Upstream commit 9d02831e51 ]

sctp_sf_ootb() is called when processing DATA chunk in closed state,
and many other places are also using it.

The vtag in the chunk's sctphdr should be verified, otherwise, as
later in chunk length check, it may send abort with the existent
asoc's vtag, which can be exploited by one to cook a malicious
chunk to terminate a SCTP asoc.

When fails to verify the vtag from the chunk, this patch sets asoc
to NULL, so that the abort will be made with the vtag from the
received chunk later.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2021-11-02 19:48:24 +01:00
..
6lowpan 6lowpan: iphc: Fix an off-by-one check of array index 2021-09-15 09:50:34 +02:00
9p 9p/trans_virtio: Remove sysfs file on probe failure 2021-09-26 14:08:57 +02:00
802 net/802/garp: fix memleak in garp_request_join() 2021-07-31 08:16:11 +02:00
8021q net: vlan: avoid leaks on register_vlan_dev() failures 2021-01-17 14:16:55 +01:00
appletalk appletalk: Fix skb allocation size in loopback case 2021-04-07 15:00:08 +02:00
atm net: atm: fix update of position index in lec_seq_next 2020-10-31 12:26:30 -07:00
ax25
batman-adv net: batman-adv: fix error handling 2021-11-02 19:48:22 +01:00
bluetooth Bluetooth: Fix handling of LE Enhanced Connection Complete 2021-09-18 13:40:29 +02:00
bpf bpf, test, cgroup: Use sk_{alloc,free} for test cases 2021-10-27 09:56:56 +02:00
bpfilter bpfilter: Specify the log level for the kmsg message 2021-07-14 16:56:29 +02:00
bridge net: bridge: mcast: use multicast_membership_interval for IGMPv3 2021-10-27 09:56:54 +02:00
caif net-caif: avoid user-triggerable WARN_ON(1) 2021-09-22 12:27:56 +02:00
can can: isotp: isotp_sendmsg(): fix TX buffer concurrent access in isotp_sendmsg() 2021-10-27 09:56:56 +02:00
ceph libceph: clear con->out_msg on Policy::stateful_server faults 2020-10-12 15:29:27 +02:00
core net: Prevent infinite while loop in skb_tx_hash() 2021-11-02 19:48:22 +01:00
dcb net: dcb: Accept RTM_GETDCB messages carrying set-like DCB commands 2021-01-23 16:04:01 +01:00
dccp dccp: don't duplicate ccid when cloning dccp sock 2021-09-22 12:27:56 +02:00
decnet net: decnet: Fix sleeping inside in af_decnet 2021-07-28 14:35:38 +02:00
dns_resolver
dsa net: dsa: don't allocate the slave_mii_bus using devres 2021-09-30 10:11:02 +02:00
ethernet
ethtool ethtool: Fix rxnfc copy to user buffer overflow 2021-09-22 12:27:56 +02:00
hsr net: hsr: fix mac_len checks 2021-06-03 09:00:50 +02:00
ieee802154 net: Fix memory leak in ieee802154_raw_deliver 2021-08-18 08:59:12 +02:00
ife
ipv4 tcp_bpf: Fix one concurrency problem in the tcp_bpf_send_verdict function 2021-11-02 19:48:21 +01:00
ipv6 ipv6: When forwarding count rx stats on the orig netdev 2021-10-27 09:56:48 +02:00
iucv net/af_iucv: remove WARN_ONCE on malformed RX packets 2021-03-07 12:34:05 +01:00
kcm
key af_key: relax availability checks for skb size calculation 2021-02-13 13:55:02 +01:00
l2tp net/l2tp: Fix reference count leak in l2tp_udp_recv_core 2021-09-22 12:27:56 +02:00
l3mdev
lapb net: lapb: Copy the skb before sending a packet 2021-02-10 09:29:14 +01:00
llc net: llc: fix skb_over_panic 2021-08-04 12:46:43 +02:00
mac80211 mac80211: check return value of rhashtable_init 2021-10-17 10:43:33 +02:00
mac802154 net: mac802154: Fix general protection fault 2021-04-14 08:42:13 +02:00
mpls net: avoid infinite loop in mpls_gso_segment when mpls_hlen == 0 2021-03-17 17:06:11 +01:00
mptcp mptcp: don't return sockets in foreign netns 2021-10-06 15:55:52 +02:00
ncsi net/ncsi: Avoid channel_monitor hrtimer deadlock 2021-04-14 08:42:08 +02:00
netfilter netfilter: Kconfig: use 'default y' instead of 'm' for bool config option 2021-10-27 09:56:53 +02:00
netlabel net: fix NULL pointer reference in cipso_v4_doi_free 2021-09-18 13:40:35 +02:00
netlink netlink: annotate data races around nlk->bound 2021-10-13 10:04:27 +02:00
netrom netrom: Decrease sock refcount when sock timers expire 2021-07-28 14:35:38 +02:00
nfc nfc: nci: fix the UAF of rf_conn_info object 2021-10-27 09:56:53 +02:00
nsh
openvswitch ovs: clear skb->tstamp in forwarding path 2021-08-26 08:35:50 -04:00
packet net/packet: annotate accesses to po->ifindex 2021-06-30 08:47:22 -04:00
phonet
psample net: psample: Fix netlink skb length with tunnel info 2021-03-07 12:34:07 +01:00
qrtr net: qrtr: fix another OOB Read in qrtr_endpoint_post 2021-09-03 10:09:21 +02:00
rds net/rds: dma_map_sg is entitled to merge entries 2021-09-03 10:09:28 +02:00
rfkill rfkill: Fix use-after-free in rfkill_resume() 2020-11-12 09:18:06 +01:00
rose rose: Fix Null pointer dereference in rose_send_frame() 2020-11-20 10:04:58 -08:00
rxrpc rxrpc: Fix clearance of Tx/Rx ring when releasing a call 2021-02-17 11:02:28 +01:00
sched mqprio: Correct stats in mqprio_dump_class_stats(). 2021-10-20 11:45:06 +02:00
sctp sctp: add vtag check in sctp_sf_ootb 2021-11-02 19:48:24 +01:00
smc net/smc: fix 'workqueue leaked lock' in smc_conn_abort_work 2021-09-30 10:11:02 +02:00
strparser
sunrpc SUNRPC: fix sign error causing rpcsec_gss drops 2021-10-13 10:04:24 +02:00
switchdev net: switchdev: don't set port_obj_info->handled true when -EOPNOTSUPP 2021-02-07 15:37:12 +01:00
tipc tipc: fix size validations for the MSG_CRYPTO type 2021-11-02 19:48:19 +01:00
tls net/tls: Fix flipped sign in async_wait.err assignment 2021-11-02 19:48:23 +01:00
unix af_unix: fix races in sk_peer_pid and sk_peer_cred accesses 2021-10-06 15:55:58 +02:00
vmw_vsock vsock/virtio: avoid potential deadlock when vsock device remove 2021-08-18 08:59:14 +02:00
wimax genetlink: move to smaller ops wherever possible 2020-10-02 19:11:11 -07:00
wireless cfg80211: correct bridge/4addr mode check 2021-11-02 19:48:22 +01:00
x25 net/x25: Return the correct errno code 2021-06-18 10:00:06 +02:00
xdp xsk: Fix broken Tx ring validation 2021-07-14 16:56:23 +02:00
xfrm net: xfrm: Fix end of loop tests for list_for_each_entry 2021-08-26 08:35:35 -04:00
compat.c net: Return the correct errno code 2021-06-18 10:00:06 +02:00
devres.c
Kconfig
Makefile
socket.c ethtool: improve compat ioctl handling 2021-09-18 13:40:21 +02:00
sysctl_net.c