Qian Zhang (张谦) reported a potential socket buffer overflow in tipc_msg_build() which is also known as CVE-2016-8632: due to insufficient checks, a buffer overflow can occur if MTU is too short for even tipc headers. As anyone can set device MTU in a user/net namespace, this issue can be abused by a regular user. As agreed in the discussion on Ben Hutchings' original patch, we should check the MTU at the moment a bearer is attached rather than for each processed packet. We also need to repeat the check when bearer MTU is adjusted to new device MTU. UDP case also needs a check to avoid overflow when calculating bearer MTU. Fixes: b97bf3fd ("[TIPC] Initial merge") Signed-off-by:Michal Kubecek <mkubecek@suse.cz> Reported-by:
Qian Zhang (张谦) <zhangqian-c@360.cn> Acked-by:
Ying Xue <ying.xue@windriver.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
Name |
Last commit
|
Last update |
---|---|---|
.. | ||
Kconfig | Loading commit data... | |
Makefile | Loading commit data... | |
addr.c | Loading commit data... | |
addr.h | Loading commit data... | |
bcast.c | Loading commit data... | |
bcast.h | Loading commit data... | |
bearer.c | Loading commit data... | |
bearer.h | Loading commit data... | |
core.c | Loading commit data... | |
core.h | Loading commit data... | |
discover.c | Loading commit data... | |
discover.h | Loading commit data... | |
eth_media.c | Loading commit data... | |
ib_media.c | Loading commit data... | |
link.c | Loading commit data... | |
link.h | Loading commit data... | |
monitor.c | Loading commit data... | |
monitor.h | Loading commit data... | |
msg.c | Loading commit data... | |
msg.h | Loading commit data... | |
name_distr.c | Loading commit data... | |
name_distr.h | Loading commit data... | |
name_table.c | Loading commit data... | |
name_table.h | Loading commit data... | |
net.c | Loading commit data... | |
net.h | Loading commit data... | |
netlink.c | Loading commit data... | |
netlink.h | Loading commit data... | |
netlink_compat.c | Loading commit data... | |
node.c | Loading commit data... | |
node.h | Loading commit data... | |
server.c | Loading commit data... | |
server.h | Loading commit data... | |
socket.c | Loading commit data... | |
socket.h | Loading commit data... | |
subscr.c | Loading commit data... | |
subscr.h | Loading commit data... | |
sysctl.c | Loading commit data... | |
udp_media.c | Loading commit data... | |
udp_media.h | Loading commit data... |