kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/net/xfrm
History
Florian Westphal 66e1f97832 xfrm_user: uncoditionally validate esn replay attribute struct 
commit d97ca5d714 upstream.

The sanity test added in ecd7918745 can be bypassed, validation
only occurs if XFRM_STATE_ESN flag is set, but rest of code doesn't care
and just checks if the attribute itself is present.

So always validate.  Alternative is to reject if we have the attribute
without the flag but that would change abi.

Reported-by: syzbot+0ab777c27d2bb7588f73@syzkaller.appspotmail.com
Cc: Mathias Krause <minipli@googlemail.com>
Fixes: ecd7918745 ("xfrm_user: ensure user supplied esn replay window is valid")
Fixes: d8647b79c3 ("xfrm: Add user interface for esn and big anti-replay windows")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
History 2018-06-16 22:22:13 +01:00
..
Kconfig net/xfrm: remove depends on CONFIG_EXPERIMENTAL 2013-01-11 11:40:03 -08:00
Makefile xfrm: make xfrm_algo.c a module 2012-05-15 13:13:34 -04:00
xfrm_algo.c net: move pskb_put() to core code 2013-11-07 19:28:58 -05:00
xfrm_hash.c net: allow GFP_HIGHMEM in __vmalloc() 2010-11-21 10:04:04 -08:00
xfrm_hash.h net: misc: Remove extern from function prototypes 2013-10-19 19:12:11 -04:00
xfrm_input.c xfrm: Use __skb_queue_tail in xfrm_trans_queue 2018-03-03 15:52:13 +00:00
xfrm_ipcomp.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2013-11-04 13:48:30 -05:00
xfrm_output.c net: make skb_gso_segment error handling more robust 2015-05-20 13:25:55 +01:00
xfrm_policy.c xfrm: policy: check policy direction value 2017-09-15 18:30:18 +01:00
xfrm_proc.c net: clean up snmp stats code 2014-05-07 16:06:05 -04:00
xfrm_replay.c xfrm: Fix aevent generation for each received packet 2013-09-25 07:32:48 +02:00
xfrm_state.c xfrm: Clear sk_dst_cache when applying per-socket policy. 2018-01-01 20:51:59 +00:00
xfrm_sysctl.c net: Don't export sysctls to unprivileged users 2012-11-18 20:30:55 -05:00
xfrm_user.c xfrm_user: uncoditionally validate esn replay attribute struct 2018-06-16 22:22:13 +01:00