kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/xfrm
History
Vladis Dronov 60166dc935 xfrm: policy: check policy direction value 
commit 7bab09631c upstream.

The 'dir' parameter in xfrm_migrate() is a user-controlled byte which is used
as an array index. This can lead to an out-of-bound access, kernel lockup and
DoS. Add a check for the 'dir' value.

This fixes CVE-2017-11600.

References: https://bugzilla.redhat.com/show_bug.cgi?id=1474928
Fixes: 80c9abaabf ("[XFRM]: Extension for dynamic update of endpoint address(es)")
Reported-by: "bo Zhang" <zhangbo5891001@gmail.com>
Signed-off-by: Vladis Dronov <vdronov@redhat.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2017-09-15 18:30:18 +01:00
..
Kconfig net/xfrm: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:03 -08:00
Makefile xfrm: make xfrm_algo.c a module 2012-05-15 13:13:34 -04:00
xfrm_algo.c net: move pskb_put() to core code 2013-11-07 19:28:58 -05:00
xfrm_hash.c net: allow GFP_HIGHMEM in __vmalloc() 2010-11-21 10:04:04 -08:00
xfrm_hash.h net: misc: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
xfrm_input.c xfrm: Fix crash observed during device unregistration and decryption 2016-05-01 00:06:14 +02:00
xfrm_ipcomp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-04 13:48:30 -05:00
xfrm_output.c net: make skb_gso_segment error handling more robust 2015-05-20 13:25:55 +01:00
xfrm_policy.c xfrm: policy: check policy direction value 2017-09-15 18:30:18 +01:00
xfrm_proc.c net: clean up snmp stats code 2014-05-07 16:06:05 -04:00
xfrm_replay.c xfrm: Fix aevent generation for each received packet 2013-09-25 07:32:48 +02:00
xfrm_state.c xfrm: Fix memory leak of aead algorithm name 2016-11-20 01:17:32 +00:00
xfrm_sysctl.c net: Don't export sysctls to unprivileged users 2012-11-18 20:30:55 -05:00
xfrm_user.c xfrm_user: validate XFRM_MSG_NEWAE incoming ESN size harder 2017-06-05 21:17:20 +01:00